Trojan.StartPage.59023

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsf2.tmp\NSISdl.dll
%TEMP%\nsf2.tmp\Math.dll
%TEMP%\nsf2.tmp\System.dll

Удаляет следующие файлы:

%TEMP%\nsf2.tmp\System.dll
%TEMP%\nsf2.tmp\NSISdl.dll
%TEMP%\nsf2.tmp\Math.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'zbbflgackreievrzipfayjxfkyazjznkprp' WindowName: 'uzmielvosbhicxivubhurqpapqu'
ClassName: 'xmwfvbiquwgdcvomotrboufngwfuszwonbdvq' WindowName: 'wadagicamvuinhqhy'
ClassName: 'zmymzldhohwiyyfghshingnbzjfyhivo' WindowName: 'xfhrbpdxzebtymusqyhjalcknphukypnmtomr'
ClassName: 'oifdjrswnmfjybyowpzasmhzvoabdxdpbj' WindowName: 'nmenduaklszsxyyvex'
ClassName: 'ecydmrtrkkxxcvgskr' WindowName: 'ibuschrxyknnfxpimuscddnugdoluq'
ClassName: 'yxmlakanppipvxjnqqdckwdoemluw' WindowName: 'zixcnwbonfzvznisrfz'
ClassName: 'eciupaqlxthvhdpkuxdudtnjeiovxgu' WindowName: 'pfrmeqocyxcpcddrfbzcp'
ClassName: 'yrxwlxjcyisnpgqvigerhc' WindowName: 'rthfmuavorcrpelitzwusvgnd'
ClassName: 'bnurguzoikpirqjoyomlmqmzxm' WindowName: 'duxxiwvgkmphqshulcvtqcmyooctcafgagcgos'
ClassName: 'mbqvhdtzrqaofppampmtagncsqgwbyah' WindowName: 'kiepuotmovizjgwtrwgwc'
ClassName: 'awhqqddyaskripbhv' WindowName: 'msdoezgvholykbenftspattn'
ClassName: 'rrvfgnplhqqyzeodjxjkl' WindowName: 'lkntvjbgoapgslktyokjhurhdkqcmupwkuh'
ClassName: 'zvwcktlgqcmgcjwrl' WindowName: 'qktfjcuvaxdbmxolqtndmrjusqa'
ClassName: 'axudnwbepirmrxxdprkiyretrxbxnadyvqmykn' WindowName: 'pkbyomgpialrhpxtpeg'
ClassName: 'ocgacrwqdlhjlgihpztaslpj' WindowName: 'avpxzzrrqdsyqsuwk'
ClassName: 'wzljsymdushzzwjbugmgfaxinzvdzigqbeg' WindowName: 'qdjtclrrbguthnquerottdgtq'
ClassName: 'pudfdzscotlmtorsvho' WindowName: 'uzvvlkiyasfnaamthdnplrhsua'
ClassName: 'vpxuvjoycrmdqkrzkkvllodfajurbst' WindowName: 'cfyguribqonnpmcuaxadicdfpkvtjmnixcllpo'
ClassName: 'lihqhpacofjoambdbcgktqnhacu' WindowName: 'gjoloywmtmrzlky'
ClassName: 'ydrwcpycrjhbfdwvq' WindowName: 'ssthokctsbpwktxhlghzskyzvxvblpscnrkx'
ClassName: 'luenlacdajosviewweab' WindowName: 'nkpqclefqgajcftwnpdjli'
ClassName: 'juqzmymbtqukkhqqatqdfzcvfsydiewblopx' WindowName: 'qnciebmpcqcsaqfmalwvtqaqdyfrafdllbd'
ClassName: 'rtiphvoxhubaqrdkimotkcgpntpdeufgu' WindowName: 'deipboeqqtqwvbsnxancybu'
ClassName: 'aedctfyjhzcweqhymiguvaqqjylglaivlen' WindowName: 'zwvnhhxbmwkmltaisfls'
ClassName: 'ifpfnxxmjdllpychcnhcgzvxmzexwcjkzfoyuuq' WindowName: 'omfoxtkuzlylpsimegnkiubfoxr'
ClassName: 'ooatvihdngdoptuwyvipyecx' WindowName: 'gqfgetlclrandtungxhyhndkrjdk'
ClassName: 'sybzzwkaklxdrutbnjo' WindowName: 'ojfkbgclzkgznhwvfzwc'
ClassName: 'loxnyhmguuumsfhsjqrnrdsisskhpbmfvqautqy' WindowName: 'rsywbcwtslbbsmyeaoiidxll'
ClassName: 'xsugtxosshjqjgemsmzohjbmvtznrh' WindowName: 'gnwylsavtrswucjgemckvsbjs'
ClassName: 'cfvvageiomrdnlhabvekjwgq' WindowName: 'xucoydmuptbwmifthwcpljmedkdtcgztzxny'
ClassName: 'jmmnllofvvwetrcyrnmbbwlyhnczhrrxskjbydb' WindowName: 'mhtfgynenzbocasntajiztzzmbvbhowp'
ClassName: 'cipjlbmbodrpdmmhdff' WindowName: 'wjldbkeprulqpvnczmmqmqvownqeefybnqt'
ClassName: 'selujcpepfjwtnmagmrcsa' WindowName: 'nhqicyhyuqduxecqxhdbydtdqmiqrhlca'
ClassName: 'octtgfrwuxiobcuicpcmoajqe' WindowName: 'fmlpnpnbqflmjii'
ClassName: 'bgvykpypcshyoxan' WindowName: 'xdakkzcntbsymxatdsuavybi'
ClassName: 'xmfazdplhzdthrfmjakzgcicnaduyvkw' WindowName: 'ambopylmdybvwrrtuiwklchrvz'
ClassName: 'usimxpowcfpcufnsycftu' WindowName: 'lriqqsadufyuesoijnmcgjesrikvi'
ClassName: 'dnmpdluuimwcfwkbrbiznmcwwtywlfkgdsdj' WindowName: 'yhdwwhpirkxjzexrokxpdrdbbhpgnj'
ClassName: 'rhvplgxikhdwwghubueantzawhwvbsaa' WindowName: 'mjfprgkzkmpnjvtfnffxr'
ClassName: 'hkzzbifiwrhogmjufdmlfefdwobmawcywbnl' WindowName: 'ymexaghtihjnijcpsmambuwkzm'
ClassName: 'mswczfvfvcdqxyxuhhkzmcryyipdsaqul' WindowName: 'ctkaccvsrqdnpluonhnaxxqpbyht'