Trojan.StartPage.59468

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsa2.tmp\InetLoad.dll
%TEMP%\nsa2.tmp\NSISdl.dll
%TEMP%\nsa2.tmp\System.dll
%TEMP%\nsa2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsa2.tmp\NSISdl.dll
%TEMP%\nsa2.tmp\System.dll
%TEMP%\nsa2.tmp\InetLoad.dll
%TEMP%\nsa2.tmp\Math.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'levroqfeemdrqdahljsmcvlnrewvvapa' WindowName: 'hazyikusczolvgixisjyptqisnwjltedcdr'
ClassName: 'zilpjslalczkvme' WindowName: 'juliefhqgoyoylcpllakqiuisrxvlyaxx'
ClassName: 'pymnugfsaqcsedordycklvyqpyjyzaetan' WindowName: 'asjlpxdfnimpfvdoep'
ClassName: 'ewfspfijqeawwdaad' WindowName: 'retjxxhmgyxvybssvhsikvueeq'
ClassName: 'qsirvoqeebxfskcbkxlcgkftxeaxjusva' WindowName: 'unwfepgwqqbsyia'
ClassName: 'yvejzaksrnjkrwbqfljrhiwdyx' WindowName: 'nwyykqzcftyrxsjzbdbtsqfogtkdrtflxf'
ClassName: 'zxeoezbyexqljqjdzyvopknufqfmdltynga' WindowName: 'xidqcbfbdrkstkckohhnw'
ClassName: 'hwulmxpwajiqiihuqtzzwrxgbx' WindowName: 'kadmffmykipzficjnlcshnqytbsqjhx'
ClassName: 'udpltsyomveuaxkzngjafjmgkfcydv' WindowName: 'fonraauuugcotwczfktepmqkhtqzx'
ClassName: 'kcepmmjmvrsftyrfzmoyylwwqje' WindowName: 'krsbhuzhfihwdyuiuskypnvsextcclbpbycczdf'
ClassName: 'nwyghqpbgfkaigy' WindowName: 'eqblcilescuplemiaxrqpootoilobhyrjxkjbk'
ClassName: 'olzjllwbhohzifhkhfq' WindowName: 'isxnodpbcuhdexgpiyhcjaq'
ClassName: 'iyfzfllejukhwwss' WindowName: 'zixuaphxeymexwuccgya'
ClassName: 'vmyniwuqmoxpyrdljuiuysgvtmgymyswsmlj' WindowName: 'zcxibffiztugkatmqchgktpypnwxpc'
ClassName: 'qzckbjcsfiedlccvtfm' WindowName: 'obcqzcsrxycowmaponlexb'
ClassName: 'abdyyqzqzyaemzxaijnuvhl' WindowName: 'ziygbmgzunfeqriviytonszvm'
ClassName: 'hypppypjkoselhdfqlyamhzslwzzjsrntny' WindowName: 'ljzexooxjewppaknoyqgdpibqccagovqi'
ClassName: 'xtpkwbsmdnfcbfifkxwpijgxsmpz' WindowName: 'ymsmyeahevmbejxkkcdufvivykngl'
ClassName: 'dhbexmpcoqjtxjlneasicy' WindowName: 'cdjqqzgolfiippxkozlmhnxifygavjsked'
ClassName: 'zmxouaewmsakfmkxzasaroglexvslnty' WindowName: 'anpaxympneuapgtjmwqzmobhevtnrjdgtkrddo'
ClassName: 'scqskzbhkcvdbxxbbnyynmpdjkc' WindowName: 'nlfwomjjxzwztavylhyce'
ClassName: 'mtwflpwwkmoniuqdghaybawh' WindowName: 'vbmjuwbujvhxivxzyojzymhfxnxztzelu'
ClassName: 'mtphgrtdgbjaobmwchlyvblrqkfro' WindowName: 'jiqpbdmxpnmhtwrs'
ClassName: 'opppuuwpxsmhvhwjyaselsgxhakwqoqdxdxhjg' WindowName: 'wtokecfdvzigxvucjedzxkpnnc'
ClassName: 'urxuvypifzlcexru' WindowName: 'tcqnrdhjtheyratbysxjejphpxdmd'
ClassName: 'lcwrtekdnowobsbutvcgpcqzprjjsms' WindowName: 'rmuczootigdhblijbimkreadluvijkvb'
ClassName: 'phuxkzcsyewjcbmos' WindowName: 'nvweqaizamstgfosikaxdoanwdy'
ClassName: 'vvoeypoljwflqyvkujbpmpxzskquddcjfz' WindowName: 'xmrxmxzjqvxlrcivciyfxpktbvmkmme'
ClassName: 'ehwkxlapagbtxtbhcbygjihsypnetqlnwxs' WindowName: 'jvdqrygubmfcpmtxtnkjesr'
ClassName: 'hbqlwrmqkjutoturnsmcfcpvxdtskerxheerivj' WindowName: 'xilzofekpwmhibzrvgscyupywzzqrtru'
ClassName: 'zlgwdanwnjkcxajmpykxqcpwoajudxzj' WindowName: 'gbxllcvldsoqiqslnsxydaufoe'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'jlfghciyshcuxgmwbunseg' WindowName: 'toabfvbnvdyzrrszddrbxtwaxxqbpbgpipemgo'
ClassName: 'uoxmljpzfjagumoejjlbvm' WindowName: 'dmyuejhexggzxsznauiqugvunfleqamefrzfai'
ClassName: 'qgnqjhbdyowwvbdnr' WindowName: 'maauzluwifzkqhtad'
ClassName: 'eewnawuwmsiqzhhzsrtfinnqc' WindowName: 'tctatnqzhmjfcekaw'
ClassName: 'dlvjmfqakriwzxrcybfzpvdsahnlld' WindowName: 'lqpbsiwfxvzhqotxajmdvcbdjwmmr'
ClassName: 'hvfqgsqycrdhxnsdyxblcghc' WindowName: 'miiwnqusrilgehnhlfzqayo'
ClassName: 'invrphxdfhtbppcsszadhdvyspauzxeujkftwe' WindowName: 'hlyygbrakcelgtogmyrbamyejmtepiunwwzwp'
ClassName: 'wuaqbxwrucwwemybaekadczqsqxttqkrr' WindowName: 'xoiuxfiadrlohgckhiunqgqbygxpngk'