Trojan.StartPage.58738

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsc2.tmp\NSISdl.dll
%TEMP%\nsc2.tmp\Math.dll
%TEMP%\nsc2.tmp\System.dll

Удаляет следующие файлы:

%TEMP%\nsc2.tmp\System.dll
%TEMP%\nsc2.tmp\NSISdl.dll
%TEMP%\nsc2.tmp\Math.dll

Сетевая активность:

Подключается к:

'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'yesvpkhrecmckjpdqlhtqdevdqkbdvdyv' WindowName: 'xkysxaxknbxlnczcfmlcntnnrdzlvkw'
ClassName: 'mksklfwzfzzzlfbibhnzw' WindowName: 'pspeutlonaisrrirdpxcriidzew'
ClassName: 'kfwfgsquqrkavsiqsicljbucoivjtbe' WindowName: 'hwddlskpkwwyrtjjmkdrkeeeypoecluci'
ClassName: 'qufufmthfdpgasqooqspsaepaphlsvy' WindowName: 'yrelakvgexbteysxpri'
ClassName: 'jmsqzeznjrwdygttfzlz' WindowName: 'oqnjsxudhblzrkkfriwhrussjibs'
ClassName: 'xgzbtzjyaeoktmgodbojdvvatd' WindowName: 'xjzibyrfmbfswbohhuiekkepuseisxjrlinm'
ClassName: 'nnlzssusekfcutbxuxbmoqwuhzipohasa' WindowName: 'wwatpxcuwibalaharwewiyoorut'
ClassName: 'yupywqnjlmczqrfmrzxptrwdtzkgmspawvmifet' WindowName: 'qgxxuxdpsgxmaoznpxehjdwoakzzjij'
ClassName: 'ivatpazgbbnaksuqmgq' WindowName: 'iqtzodkqylpfjbxndvfzb'
ClassName: 'qtcbfkskwsvzuktur' WindowName: 'yroiqiqvsonwprnqwpenngcavsxftsmmkgiebl'
ClassName: 'miuokxbwfruyskecoefhqaymhdtpikijultcnmy' WindowName: 'wjcewzfixpuchzapmmmaffoaxuuq'
ClassName: 'tmxolymxfpgphvuq' WindowName: 'pqxgehyfflfcegiemvedbuhkymelfp'
ClassName: 'jbxdrlmayawiidpbxwndvessqobosmocoh' WindowName: 'xslhqgulcjupudvyvajd'
ClassName: 'pbsmveoovggfqefkiyygmvxridzohojpwvrn' WindowName: 'vzfhtnybpclzrpbnhn'
ClassName: 'yeidvnuotqhnrjdvskzvmlhapwtxtvzmkledql' WindowName: 'scmikmmrktqkotw'
ClassName: 'qtxqrqqlqjygnpqfwbykpbmkpcbqzunta' WindowName: 'epryuwqgkslqvoiiayp'
ClassName: 'mpatvwowcdyvrfkzswnkyjqqlhoilcbhsugsbo' WindowName: 'gvdgwvzsdvismnrlnqbbrmcyrruxkwvzh'
ClassName: 'szecxlnbzuhedrvdnzvwgjjo' WindowName: 'uylowtjemyxeczxfbpmmwlpkzckjxgrgfxapmo'
ClassName: 'ldbhvnrfssubbxemuhlpocv' WindowName: 'rolasgnpuculrxskkhnvzmlurcxxi'
ClassName: 'kqlihojmbfscgwyfwu' WindowName: 'ctfdqctjmlrrdlgvhhay'
ClassName: 'npvhkmnijvipmnfqwituczhdlpxclekmzqssx' WindowName: 'qyzfnatrhiekvoouchkbfm'
ClassName: 'oqxakcbjfyuumklarktriudwe' WindowName: 'hgfnagctxsqzvcmdeqhfrmyrwxmnaeauptvz'
ClassName: 'tdbsaedolucudvdlhphlcwfhiw' WindowName: 'litcnqhmsxdhuiuxtlriqqwaqj'
ClassName: 'xwlakgshwqczmmnbnm' WindowName: 'vehhqabooypxlarlukxnjhhgahemthnyodnzw'
ClassName: 'jtptmklrzxalsudqcgmencgrpimxwaedqbc' WindowName: 'kgpobdrkdogfatyfiqfjokycfppkdihnaobvqy'
ClassName: 'gntuywyzfmsfpkpmuzzen' WindowName: 'sptygijozqvjhctoyntn'
ClassName: 'iecktsinqwhdcrwjr' WindowName: 'dzvbofjxowwfdlfsorl'
ClassName: 'ncfqaathirkjoyuyayijxgggsrnq' WindowName: 'auvsyfruvnblftbpcvienjcjorzgsffaubs'
ClassName: 'aoesgxilnxhrqpgiwgqlfdky' WindowName: 'sfhhygizngfvacc'
ClassName: 'tswgiklzigbndswowpnidhosformodw' WindowName: 'jorzccvnzgdwejdjopnqduqytktgejcqys'
ClassName: 'rswpngmleocooaousbejqboingvknxv' WindowName: 'drvixmzihioyfwqulzo'
ClassName: 'lzbzjopgifyqwvon' WindowName: 'gzelhykqpcfelqrfrsxuvivncmfyxhuzhqflzp'
ClassName: 'fjnmugjbemsmkawrl' WindowName: 'rqfiaakuevnokkusbc'
ClassName: 'tjkavlkoovhbabvyebxnjvalf' WindowName: 'gsxpnjoauekvsnijpnkrvbisnqa'
ClassName: 'urocqpctybaynprjvjskgtrwyzxpnh' WindowName: 'phgzrysnnabnzqgryrylvcweyehkzy'
ClassName: 'yxihvujazsrdcoyrzkjqioodnnlxwtbkx' WindowName: 'bxjnxkbjdnxwepnbcfncfiadmcgiozf'
ClassName: 'umizaaybqeycrchvowuunuhrdgvl' WindowName: 'qpqscnaafcourhcfcatxxqmnetidgasqlvh'
ClassName: 'ckdcplpwpywycdcglsqppawk' WindowName: 'fhnhgeogtvgdfbjwevmtxsnymeuujeczuda'
ClassName: 'mcmlzneiumwlvzgux' WindowName: 'pmnfdjlelusqjnsavnkllrm'
ClassName: 'bbwypjwmwvubjqeqslaxpffqnkjhsue' WindowName: 'osezrpfwvqotzwawyzrcbtf'
ClassName: 'dgxoasrmjbqlgymtbnffeocmaeivcssnz' WindowName: 'adjntytrgtcbudxptpiqycgmgb'
ClassName: 'wqmgfymsgnokjixidmmbbqrauligwaefmlzeo' WindowName: 'qbhgqmkyxgvqfsbdolblbozxf'
ClassName: 'icsrohusqyoqimcysfbqjcvtuwesarallifjht' WindowName: 'pdnamfyryrrhygrfpkpixipsdepddv'