Trojan.StartPage.59496

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsq2.tmp\NSISdl.dll
%TEMP%\nsq2.tmp\Math.dll
%TEMP%\nsq2.tmp\System.dll

Удаляет следующие файлы:

%TEMP%\nsq2.tmp\System.dll
%TEMP%\nsq2.tmp\NSISdl.dll
%TEMP%\nsq2.tmp\Math.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'gvtyaqglnamlzffekkxvdediccofynyrbq' WindowName: 'wytjuougxzkydrxzhwcqopzxnlnutf'
ClassName: 'ugsipijgkuzqlmfjci' WindowName: 'mnlsjdqzyuqxgosbglxlibn'
ClassName: 'qbfdkjkdetpxlgbxzk' WindowName: 'cfuxipujhnqvhpuczisccntrdvnwnmxusvno'
ClassName: 'yimoxrgvlmpiivlgnfrjfahwnictjzakijd' WindowName: 'muppipfzkwuaiogsaxewtpxuimlkpgejoknk'
ClassName: 'nhrkuagzsdidutuezutao' WindowName: 'bvfkgnglhtgcdzm'
ClassName: 'pdmzstfkooloqeibsaoxgygeenkysryrfsdkv' WindowName: 'etnnbcswcymnjdnonwx'
ClassName: 'juzagzmtvewgvmcqckldy' WindowName: 'stvavwgtgpbbkwpakghfcxbktxwicu'
ClassName: 'uqgxdxqwjxzezwg' WindowName: 'lnxvqrisrjnudky'
ClassName: 'laygdqphmzonppygqamgbnrsulrvepjtbsc' WindowName: 'qyhlsqnzuzrzotyldkcrklcipw'
ClassName: 'yawkzovteuqhmrncpjkbkoxbhwvaaevjy' WindowName: 'clsqoptqazjzqyayetdlcbmiyie'
ClassName: 'okvcwkgszbyjpkopbdcwuzdgybhzdmyvjume' WindowName: 'izjbxzeetvwyyjshhonifbpmbhoqs'
ClassName: 'fyobwypkmhoxnkwjemkdxcbydqwb' WindowName: 'ljryafdenuwymiiscolzooeelcclmssozscgeg'
ClassName: 'fyjwyonmqjtzynhoyducnhxjldvxhl' WindowName: 'uarocxrnxhmzatluthbh'
ClassName: 'stfuteplrpsevvn' WindowName: 'pdojkgofmcrieggajkkisphgfvtumuu'
ClassName: 'bhgokenjbtpsbjerzudhegzxgnaakm' WindowName: 'ibwnvpjtyysxblpxvtf'
ClassName: 'ihpptghgzfajknvbroroerykj' WindowName: 'pachdxeeaaaxcnbcegcayewuqxptfmithkvs'
ClassName: 'klgbpzlspwyejbmz' WindowName: 'mtdtuufwkusefkxshynhxtdldulstlyfbqig'
ClassName: 'ffdmnmbxeuokqgkeuqtalvuaafaxm' WindowName: 'viudmsblcrrsfbvrxxbwrfcyu'
ClassName: 'msdhvteyawcycbpgmesmbkxgsvfcqnmabvos' WindowName: 'nawbaoykfffxxjtvarinpnngmcnnwtarn'
ClassName: 'bpxxffhxdrogcep' WindowName: 'pmhcufebnjatdteepdleainoacv'
ClassName: 'iogizpaebxutetdt' WindowName: 'wjmmwcmuatiqosvyuh'
ClassName: 'lgxffqdftcgzsmflkzzf' WindowName: 'malzcxsoqwzcnoxhchfhd'
ClassName: 'qouztcdniqveljooaxkoqkoldwyq' WindowName: 'swtqfgqcmdbyvefvbnukbjgcawoycl'
ClassName: 'rusrldmxjatkkdya' WindowName: 'wyykhkwyruquenwerxl'
ClassName: 'vhutdhxmnhljukuzbmxbiwmqrathxeqsx' WindowName: 'wwcxkzesstvzdopbnwtijazwukesmtwgqqnd'
ClassName: 'lgengguzrmcnlwetgywnxhtncqcslphwuzqf' WindowName: 'ndnddxaozordlewjhgegrmjryc'
ClassName: 'mgparipiybgievxqrvmtvadmoqgsw' WindowName: 'lepeuythryixeklxnegihfzbpymuoecgqqhp'
ClassName: 'tmevnhljurwkiywnaod' WindowName: 'wdpnyvhydzauitndocsviksaglhuo'
ClassName: 'dumyyybrtaitdhuexbn' WindowName: 'zdvjwswzmdskzib'
ClassName: 'mukhteybmsrpjourmceujrsustybzqaxk' WindowName: 'ejzltzagzvyzcpwmtdnrptndjiswivpsqylck'
ClassName: 'awhpspgglwezpwdclhroebmiqmmmbejfmc' WindowName: 'vxobnlhwzncwjvhguoxdglz'
ClassName: 'jdbrfyzguprlyxzlvtbsn' WindowName: 'pnzhzxpucmsjvcxbfutjrzjibkgjmasogypxs'
ClassName: 'xulzthhodxormksibflhd' WindowName: 'bjupldioouogitifn'
ClassName: 'zhhgthtscntquorwsbjzyrcoc' WindowName: 'kqonqojetvxocigskcreozllquaxx'
ClassName: 'fwbizmowibvwozrroafobnhakemwl' WindowName: 'xymuukjdzuacwbwkwipvikhiufimzwshjj'
ClassName: 'divivdauhvofjrimtpr' WindowName: 'vvpbtymtmgkfwotbe'
ClassName: 'rzpbcnbhxxggntn' WindowName: 'ixlejpblnlojqdrscurqiayooedcvii'
ClassName: 'dcxokmzuwullwzhsxzyqjqesonxobo' WindowName: 'yjvvkzwobpuafrwcekcffkofjm'
ClassName: 'ifkbjnmkyxdonlupzkgjstxuwqzuydl' WindowName: 'vyjlcrbvuxwbcryizfzqiscxdeyvyfxvxxksjcq'
ClassName: 'xckhwtufsyvmvjnpurbdnnuczmobauauejkayiw' WindowName: 'dekyorqysaoajfnhvtbodlbxwyeutzi'
ClassName: 'gwffdcneuextznofnmloqtworjunvw' WindowName: 'hziaorxsjjdgidrhvathbyfbxmyh'