Trojan.StartPage.59544

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsd2.tmp\NSISdl.dll
%TEMP%\nsd2.tmp\Math.dll
%TEMP%\nsd2.tmp\System.dll

Удаляет следующие файлы:

%TEMP%\nsd2.tmp\System.dll
%TEMP%\nsd2.tmp\NSISdl.dll
%TEMP%\nsd2.tmp\Math.dll

Сетевая активность:

Подключается к:

'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'rqgwjjbltmfxcnuizsoxjymmvy' WindowName: 'gjdwbgegwkqawgygrhmuyyokmyyoi'
ClassName: 'mwpkqskhziesklyvuiprj' WindowName: 'dinyhluhekfudliblvlhovycmdrnu'
ClassName: 'zvyvtircidrbpjcywlkbceaqzzsmqgtq' WindowName: 'wvcsrnzxrxwszylm'
ClassName: 'usqlfybhzlvyunqwlksx' WindowName: 'sllcqavohfqicowvylosaltlpgtbljapkmg'
ClassName: 'wwtxsbfidmqpyksiczcqsvlebwkh' WindowName: 'kmctzyaupqmhbzwbgwyxuqkppilexawyu'
ClassName: 'enqpmntlwgcffjsaflqlbiuh' WindowName: 'umnwxwxftcxzywiatgavrllsdnjmhqzcgyqxhfl'
ClassName: 'ykxsmvquqfizbnlohvttlhdcwitizkzwpcwf' WindowName: 'tqpzyoesjuesyxsfltwbn'
ClassName: 'eyjxaaodhtgudsallhumnpswmiudnlohx' WindowName: 'zhzsjhmjfyhkouekgwacbnah'
ClassName: 'zhfrdqvtgqjjajvlimfuczygtgafpyhtrpmortk' WindowName: 'xtzemxvngonwxytenjfdwxoxziaazjw'
ClassName: 'emlfhcgvituicxtly' WindowName: 'uuoysszgwyglkqbgnvewgkkpjf'
ClassName: 'ozfldffjoazebmyvrujccczdef' WindowName: 'goeqgukgdkkjswijfrohdeernxcmvykfyomx'
ClassName: 'ewubpwvdbtibbyxxtprnh' WindowName: 'ypgikzksboevasrmwhil'
ClassName: 'dnoqmdtcfqbmhexkidossvtxcgk' WindowName: 'dsihsznsrrfgaunajvvbtpg'
ClassName: 'jlsbxtnccqiyoskhdolffongsifwjldqeypcqx' WindowName: 'fdafzetuvxasoqepr'
ClassName: 'bvxtkxohcrbfczayperczkskgzkp' WindowName: 'dkwcsqlarggfcaxsppfgbbjlbmagkvevxnnlu'
ClassName: 'aimhdkkadjgbbxpdvwpdwmdrjgbmmnnk' WindowName: 'jmejzouwjyanrwqjdcjqyo'
ClassName: 'goxvbmnzzanogooojwvm' WindowName: 'mejergpwktpdstoyrmrww'
ClassName: 'dxhmmbazyfikqdzknsyfdhhsksawxxzzdoipaj' WindowName: 'niyymbdtsspyiekmosxskxguuboflzdlpfh'
ClassName: 'nsxmmmolswqogscpcm' WindowName: 'yeozunenkkupfskstvishfglduj'
ClassName: 'rltjoiubjzletpyrzbwgmowojaiynjphnde' WindowName: 'fddgujdgscflxwdqouzjovzllihiabbrqkckobs'
ClassName: 'vusqvbyvfkkplgzhcokrkabmhtxjurovanrznlu' WindowName: 'egxfbdankypgtdartabljyx'
ClassName: 'fapukllsasjabtuhqhlxyp' WindowName: 'rkbgbcffoltlfzzflr'
ClassName: 'fsqqadzmwdtrkpsgxrra' WindowName: 'urcduiywdodwymdvorivcichcdsvytpnxxk'
ClassName: 'xgwugfeyxyjaiiwledhnvfajejbvs' WindowName: 'jgjxrgdkputvgkxo'
ClassName: 'vjtjnhnenfewnjlbzqhozedpjpgpbg' WindowName: 'xgahncxijvlskhitexjfcbydrjlwx'
ClassName: 'axhgsdvyxpwfvfqe' WindowName: 'bpaapxaithgrfwjcawsdqaccunxfcsphkofbdz'
ClassName: 'ukwksokiannhllmftgf' WindowName: 'nanlinatmzpzwtgrxgekrpqqacojcrabnsc'
ClassName: 'nsgeymfcqcchwjdwdpdjccqpwwt' WindowName: 'prngnipagisgnfxzqxpuzmzryrshcxdlelwpv'
ClassName: 'yicqhjjmxrsgpzdxm' WindowName: 'ttysytvfepgrpsdkgzbbgubzxs'
ClassName: 'gktwczgakpjjzqdjkaqmqdebvrmzeope' WindowName: 'wsnvwoxalkcyegxn'
ClassName: 'myswhslzkfqdjdluhaxtmjxqzadtkuizbkh' WindowName: 'owcpuhtggohzoavosbbeyfydslfyeobdpm'
ClassName: 'apgmeflposiogbkjngiert' WindowName: 'phepnlcdaajksspqavoi'
ClassName: 'bdszchgqrynaaanvogbbso' WindowName: 'yuytpilhzqeqadjrhjeb'
ClassName: 'qemnfgtipfvncpiztfinctzdumfbnluj' WindowName: 'ymclrhbwmospfwwzywvodiywflrdeqgjuowi'
ClassName: 'aibffwrxfnzhyrfjiswnw' WindowName: 'knxtriwpbbrnkowzucbnoogm'
ClassName: 'hyapuszuzqufpgtenam' WindowName: 'gyrqztwmqnomvqcttnxe'
ClassName: 'yqxhkomonhkevjdqjbbnjxovmephgd' WindowName: 'sbljcvdskxqhelawmmtlghze'
ClassName: 'vvyqxezuzglpmglodimkqiqbnwsqbtd' WindowName: 'zlycxvitdvazzcjsslxnbhplanjqjjqfhfgjb'
ClassName: 'hqeendfeajbnpwdhwejjqzxhqmxodebhxjipt' WindowName: 'ssznrzktypynftslxryxndybdzyseyzsg'
ClassName: 'pbgmlezbpkehqerg' WindowName: 'pgjmutjqfhtnnhlrz'
ClassName: 'xcoqherkbwzwyqgxxablfakvjhxvzfjesu' WindowName: 'kavkelptwafocaopvquhvrpkxsmqdielw'
ClassName: 'ieioueuznabkolu' WindowName: 'jwnmxpfiblphcyijkbilaynkt'