Trojan.StartPage.59471

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsv2.tmp\InetLoad.dll
%TEMP%\nsv2.tmp\Math.dll
%TEMP%\nsv2.tmp\System.dll

Удаляет следующие файлы:

%TEMP%\nsv2.tmp\System.dll
%TEMP%\nsv2.tmp\Math.dll
%TEMP%\nsv2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'xpoznafnunnzsrwpo' WindowName: 'wmnzhgvltnqjknsbjuxudiaqrdsfynyypmtsmxl'
ClassName: 'afboswejkdwzpnjfzadelbgxffdrmr' WindowName: 'cyqqegfgietpxwpqtqkbemxyojlbivve'
ClassName: 'ombbtixjwgtrxzsnozgcmkszjqnfdujjpgjf' WindowName: 'ramjcsaiyijvszvonafrznly'
ClassName: 'cvzddkabkzptmfyz' WindowName: 'pgoambfruubudkbdclyzkposstzhbcbuqccd'
ClassName: 'qksriexhfwgnufyvmg' WindowName: 'nhwcunqtnnqkpopxcwlchdnyab'
ClassName: 'yhdcbhdmnyhfylfndrnuwvzaak' WindowName: 'rzrktirsurbcxgoksekg'
ClassName: 'muxslabjwoysitooiliidlybrsfwpmsyxy' WindowName: 'nwplnpkzvloukeulokpefn'
ClassName: 'mtwihnfcynmmbajinjrkuovrfsckcagilnzqr' WindowName: 'iqludqmtlimqkhpxmuashgzytjopafyk'
ClassName: 'itwfdaeccmuburawyosvszpegdjii' WindowName: 'fagvbrkmbmkrrswipacqnvyveuqrqmp'
ClassName: 'qfyufcviiyhhxyh' WindowName: 'jqpyfiroofuawxzffeezbhylutohweaynbyfe'
ClassName: 'dgzruxpltoeeevk' WindowName: 'swlbxvjkqlzdfhjkpowce'
ClassName: 'yxjvyeuhxamxixbeoufmvqzcejgxiffhpd' WindowName: 'xajuevkgstfhvvqu'
ClassName: 'vczfhbhzzlnikphbyufpnqyezjgtonmrvjqrtin' WindowName: 'mcdvxgoydkviciugk'
ClassName: 'bhwtxyzlsgeyyycfatx' WindowName: 'ichjtaqoheecnvyxfwpnaqzrcrtrrx'
ClassName: 'hqwpjeiyzrpklhabdwlavsijgxzfqcfy' WindowName: 'gvyofbbpeeujlsjppdhounutomdzbjjl'
ClassName: 'xzjvhfyfqkmdqyozsqvmagkbimaujcqk' WindowName: 'vvktcbesrcrnuxdmqkqbzu'
ClassName: 'gadaopyozcrcpkmsia' WindowName: 'thbhrnrgmpbvhaghxiybvqvvawooyssqyfkbabq'
ClassName: 'sczkaovlijnrfhxxujxptarwh' WindowName: 'nopzluwaddffejnyssxvpxolfvcleasi'
ClassName: 'vqcwrvitwdehlszbzjpjkeveekd' WindowName: 'bepqrocgrfvuicwjpnfithlpzjjw'
ClassName: 'rtrbkvpzoijxszdlext' WindowName: 'bvsebnycehwwtigtinm'
ClassName: 'qnaggjenkfuhkiytzwcpcbbhxvqqqxuxtmzxtha' WindowName: 'czfwqtyzetzpypagogdtidlehrfnakrcfut'
ClassName: 'uvfgfcxajswzkigkzvu' WindowName: 'nrklpzjxbvmtnmbnamuttpalfrxmxvk'
ClassName: 'whyqokvnkffkhmpqevstbiycscx' WindowName: 'bgjhpxdgkjrmmpkwthtmzxd'
ClassName: 'gqmszcurpzcqeagktjgx' WindowName: 'wmvarjisetauwpfdgbkznjudxkelnjwnlzxb'
ClassName: 'lfnmnimtddbujmsmzjhfbznraje' WindowName: 'klbsxgffnwejsnsfbfnezovfvzcofnnfiheho'
ClassName: 'wkvoymghjpsftcunsxtaglvaxgk' WindowName: 'quktbvljkoxojuhxolprjxydgfjkerjddpgfr'
ClassName: 'cfjzpnsjrgdvqtneoffmdpx' WindowName: 'foyaqxpylkexnlndcendokowzqlyyuozjalsaqe'
ClassName: 'qumiwwtjbsvzmzcpkkmfmogjskmyeaapx' WindowName: 'xhjrsrlozdodndg'
ClassName: 'tmmfopfiwokquikof' WindowName: 'cjjiaibbzkbbtadhrxvwcfpjutkvej'
ClassName: 'xpoobdgbqxkqndhbruwgaojjthil' WindowName: 'kgqwwanoapdfahrdjijmkfjxsnhtew'
ClassName: 'gutlbmerujcrsmmiqjqxbzjlhthvrykojv' WindowName: 'rqcmdwqpicqgpcpldousp'
ClassName: 'ccdnzzrrvjxmyai' WindowName: 'fiefjkxixxcvldtcpyhgnjmshjhelsaucq'
ClassName: 'nvgkudwyedexfnnyy' WindowName: 'nxxwwgtkugbehiavfiwzjtwgvcmmieehjcv'
ClassName: 'rjuzwyzbprtedmzlhelrnrxyg' WindowName: 'nyjvevushbqrajrgsnu'
ClassName: 'szscutsepalhgptygptjzzdjkjecyn' WindowName: 'ricxcprwgbqyjaqgvdjkrosuqedfelkv'
ClassName: 'ehffynkdrutcuceqlhanggsyycsqybsmzfw' WindowName: 'bpzkqacejacahpnniffzoh'
ClassName: 'bogeyozzwowfngdskddvxafazgcrokjhc' WindowName: 'faxbxbkiwzumxeejzaoiayeig'
ClassName: 'wqbgwlzrubuozjyts' WindowName: 'ypfnzwlsyshdptrjqtfejvfzqdnxfijxivz'
ClassName: 'rlxarncwasznarjcfhlrimfyycqucq' WindowName: 'mllngnfqhmfpvovnmkqpasqnspnwhqlw'
ClassName: 'jgncissxtposbopzlhsmsi' WindowName: 'hlwjtripxxiqggy'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'sahoumzkkjbuapjnmtqvoqukz' WindowName: 'sdxuorxsvajzwggdowukj'
ClassName: 'gwyjuinwljnyxedigvimszvnuwsbvanwmjphhg' WindowName: 'ddznyuysbcsokypmtugfdetehv'
ClassName: 'xososuljekekpwuqjyjopdsdj' WindowName: 'gxqpauijohdykmyxoesukxydyiwaegn'
ClassName: 'nnywnqyrqbnbjlbbdmvucklvxomoerkj' WindowName: 'tngcnmypkehvahhfqljrrkqwe'
ClassName: 'golkawlpgdqlabdf' WindowName: 'xzwvaebcfyknkqconxkyu'