Trojan.StartPage.59000

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsj2.tmp\NSISdl.dll
%TEMP%\nsj2.tmp\Math.dll
%TEMP%\nsj2.tmp\System.dll

Удаляет следующие файлы:

%TEMP%\nsj2.tmp\System.dll
%TEMP%\nsj2.tmp\NSISdl.dll
%TEMP%\nsj2.tmp\Math.dll

Сетевая активность:

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'ruolztwudremnnonwkk' WindowName: 'fpzrtlssqngaksliwzulsvea'
ClassName: 'obqirvfagaskjgshusz' WindowName: 'mwivfzfdwnmouqrzohlezdqzksvbiayicgc'
ClassName: 'kcrsyonghopuvsxdmmngzf' WindowName: 'nrpxlavvenbpvdywwgskufhfszelstvkqkld'
ClassName: 'ohntlrojlvobsvexiggav' WindowName: 'zrekskriakmkoytfhppcqb'
ClassName: 'xudepfxqpyuerhcaoiwm' WindowName: 'hshxbbvjtsuziebkvlmwgncw'
ClassName: 'kuhtfxbekaydttvrcdmticrvlhljmxmvchjw' WindowName: 'soiopdxepapuhlyrmqygtb'
ClassName: 'equhdkgwtkzsowtuoliwlbrmxxw' WindowName: 'dcttqvafmdyhdkkxukebrnqbtzfehwcfhfrvi'
ClassName: 'tjyjhfqukchxmxkllkbpfolwrzjvofju' WindowName: 'wxbigmlfvkwqolxwhkll'
ClassName: 'wxdjmfwtqoxmbjoehppovrowyxhoih' WindowName: 'gswaolkcdivtfemwfjwmhqtbhdtfyhnnj'
ClassName: 'clmacwkxumwmmtcr' WindowName: 'xnfaebpludmmxsybtt'
ClassName: 'ikdadyftsnhsltxjuwujs' WindowName: 'muyhekknzwskzoubhunqxlfdcpnhcrtos'
ClassName: 'ozlpdeuwrmyhevfabpvnktusf' WindowName: 'jhsoqacxbnkfsdixphtdunjcgbi'
ClassName: 'rkhbtpfubilihmcwk' WindowName: 'wgzejqvmimabtyxbwteejqgpouro'
ClassName: 'enidieptnvopwvouwtmfevpvvmxnhzocnmvjh' WindowName: 'fdeqmusahemkkfdxcqgnjvmzpwvq'
ClassName: 'micnwlrosugsrampgjylsyuq' WindowName: 'dksqwgkbiamygqzuujxlacvklmaqhwojwp'
ClassName: 'oiysleguxvhmhjzczzsytmswwszpo' WindowName: 'awjxmbmyahtbmtn'
ClassName: 'ykcqllpydvskydevpnzhiqwvp' WindowName: 'cxosthxzgmbeljdxhijgnypzhz'
ClassName: 'igflivmhzbjdxidbnfxcazvkaigabukvev' WindowName: 'hwjzqmyaigbejgnmtnohxcrcbwsmxej'
ClassName: 'yfuwezburfptspwh' WindowName: 'qbhkijadwdpkhvuyiullym'
ClassName: 'diacxmjdkmpjuwpohatowwnnea' WindowName: 'opmqjptlckgrjzbzb'
ClassName: 'aeyfdrqvyytwizjfvgfhnosbchmfudqerygahf' WindowName: 'jcyzfwmrysdpwouuvpykmbvnd'
ClassName: 'inyjxcfgfjiomopmnzsyhrxtymosdpsgjyp' WindowName: 'bjreokmggdtsjxombaaehljrkgdcc'
ClassName: 'tdywkqcltzgffpdflctpeh' WindowName: 'nempgzzxszpkqolxnecoqsvumvz'
ClassName: 'fvprybwkkajdkvxuqhmmmixvpmjtetmqy' WindowName: 'nejlsaqjxkxcixuiplhzpgbcdortshrxprwjsaw'
ClassName: 'gstttlraacarqbclbtkezirtmhljdhobcquc' WindowName: 'aokcuewkvnzzfvgdfssopeyrhwrokxburbrjxcm'
ClassName: 'guybucwbveoaictwjfojtrthfpdcwleae' WindowName: 'howvfojgjsnpssehkdufvbbouzddahr'
ClassName: 'hhojgwecmkmxtakuvpz' WindowName: 'bqiutmcqchaefihhumwznkaznqtuohoizfb'
ClassName: 'yylrbomrxeekejmrdswsjvijnsueno' WindowName: 'soxvwfxkumpkyzjuwkfynenvlc'
ClassName: 'evipbgrdlvcmmrwumsibwbvqgggqqpvgdr' WindowName: 'xkgzzucpucgbpfrtkewf'
ClassName: 'nusetaulyqswgltwofzelgcljczucddj' WindowName: 'iykjhxcftnkawqjqzapizmlzbynlrgreef'
ClassName: 'zfoxspgtkahrxlefczyeeluqohlf' WindowName: 'kexuipcnjdcyoeekhzqfzztgmzx'
ClassName: 'kfzwwaoqndtosjjqgjfelrgoaayftbp' WindowName: 'mhdzaykqwvzzefynyyfelfekxahcydvyecquwzj'
ClassName: 'cunuefnbaohpazeyamoiupulrrzj' WindowName: 'ylsdlfnvltpsoxfuoichxsusbisanbhneyo'
ClassName: 'knxehaenionrwipawwkdpwtkfeknpi' WindowName: 'qtfffbqchasarlompx'
ClassName: 'vgqfvwujeatuqkxcldayiyqsgcwhfa' WindowName: 'ulwkwdsifgkwntuuwjfhzofakobxktlo'
ClassName: 'ntrkdcjrtsstlweje' WindowName: 'wglsdqwqyiasptfe'
ClassName: 'mhlshgobojagmtldwbwthfhyjzrh' WindowName: 'yvpjykspwknfbcb'
ClassName: 'niezimntmkijktou' WindowName: 'btlwfxajcewoydy'
ClassName: 'cxoddjhiixzraavmiz' WindowName: 'vaoyxkegyzsbpygyvnf'
ClassName: 'dzzpgkdjbllkbflcnzzmtabcpgoppyabeha' WindowName: 'mivrhrharwwigwycq'
ClassName: 'wkaymindugcndmxrpmlzprvmfsrjcmdfeesc' WindowName: 'qbmggyrsgayxqiatmmqr'
ClassName: 'cnpthgfvvmnzxcfgficcflc' WindowName: 'dthjopwmbupjdsfsijxcowrsrufajoyuhlyef'