Trojan.StartPage.59571

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsn2.tmp\InetLoad.dll
%TEMP%\nsn2.tmp\NSISdl.dll
%TEMP%\nsn2.tmp\System.dll
%TEMP%\nsn2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsn2.tmp\NSISdl.dll
%TEMP%\nsn2.tmp\System.dll
%TEMP%\nsn2.tmp\InetLoad.dll
%TEMP%\nsn2.tmp\Math.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'gkyktxfpnvnlyhgagrjimvbfvyl' WindowName: 'giwlqhcimjrrroubuvlszoiopxgjweokcow'
ClassName: 'tomnckajgmzsfcyvxsnlvpxrspczpgyv' WindowName: 'ukyyvlbaehommcnyvseudwwexlcbdamecxachh'
ClassName: 'rxebbxareqmldbnxuzeonwtmzcdz' WindowName: 'kgfvaguzmyzuityrlgefftcluzpzsxm'
ClassName: 'jjtdipncyepreamuvni' WindowName: 'gojgvsverytcwvwrdc'
ClassName: 'qqfhomwrmgrmlkntjugggdvenzcmvavqgegrvd' WindowName: 'yvktmuhkkljsjjxq'
ClassName: 'mucfwcltsrfdosshydqnfjnkwm' WindowName: 'drhfvhuoldrifldpupfdmdzmgpw'
ClassName: 'wgchzklwzahetbetk' WindowName: 'vobgshjpmjgrzchfpvhsadtirgazaorynhfwqs'
ClassName: 'xdglozjjjhtceszsxwao' WindowName: 'vahvvprymewvtghgmkqzdaedqofoizlcyywoif'
ClassName: 'muagufhawzcerimmfyvhqjcdtfhlrohlxar' WindowName: 'gbqojbzsxlwjjsnddfnqtbcalpkducfhyywet'
ClassName: 'muktpovjdvkinxanesflfiqmtsbrsvfcctihdi' WindowName: 'stgvqmtwrpwebbxffoe'
ClassName: 'gekvkmkktqafvoylxxjyfkxayczhbpltvjc' WindowName: 'igxlitwmiizvvobvwweinxph'
ClassName: 'tbudrgakwonwqgqehjakxwevw' WindowName: 'ivnwxwhckvqdsyuauts'
ClassName: 'ezhkoxojlusctdvhhtorygsltsbojbhcocwu' WindowName: 'rerdhosvomryfshzenykhqglwu'
ClassName: 'oiufkxqfmahrwnrdmjndrzmwmhjugkiflxzke' WindowName: 'rheirttrdiwndscyknmgvuhmysbabicpmtobvg'
ClassName: 'eqoisjygdcyefukduoqbchp' WindowName: 'qpkdfvhhagijplwkd'
ClassName: 'vceckmbfqmgmttmppjthytsnunzjyunfhbavyfj' WindowName: 'bxfeuededonbduiphk'
ClassName: 'hguwblnccwbgecbswvrkds' WindowName: 'xcuiydsrkvqbhedkjftvwzbqcdvs'
ClassName: 'iyfqcbnrunnyoixcwyfznkftkeaxu' WindowName: 'ealqtatekowcpfrdapecypfgdy'
ClassName: 'vfpwiebbftnwnunljnq' WindowName: 'xcuyrvctnrbowhdcrnw'
ClassName: 'maqeqgrohoqozxfurvcyyufleboy' WindowName: 'uqxsivjfuuyxlhmchbspcpjewoyluym'
ClassName: 'kdadusraeykbzffpierbedyjvewua' WindowName: 'nfsadunozwfeeeihbxitmg'
ClassName: 'rzuoxteziyeiujd' WindowName: 'rxpstgygoeoasuwdcnkdmnc'
ClassName: 'iiadzqqlxcsyhhxlsxlmkexqd' WindowName: 'dfcqgkbiwrgoftnjrdoecudigilglbxo'
ClassName: 'pxyerlqykbykdnxvtxrjhledijahrie' WindowName: 'bvmrzefynhiljpf'
ClassName: 'psgfxawphgatcyvupgjua' WindowName: 'ymgqaqdchniqcvp'
ClassName: 'qtjkedmytdaaqbivrcngnnqvatmy' WindowName: 'satixeiegdmhgyvbncqfbtzoycdbvpelxagfs'
ClassName: 'gvshyoalkdzbahihhxhckqxdjacpsgvsw' WindowName: 'zijmjijpymsphfvydjmtv'
ClassName: 'ifcooivhrzmjzhy' WindowName: 'mxpxyqbadpssiogjbuivvakajycnimektggyzy'
ClassName: 'qtkqgcbzamfviuibplrzxqckunpfl' WindowName: 'xedqdtstcxqxovwdwduapurhljsgri'
ClassName: 'afyixtyhrovwjgquakdmqug' WindowName: 'ysbpzswwgmxjstldqsd'
ClassName: 'vemrabrweouxpmqcwcwbfqs' WindowName: 'ljxggwopzkbjvdrjlcstzy'
ClassName: 'bioyclypylhkjvbj' WindowName: 'clgwszpcvkygfndnvcpdx'
ClassName: 'mrnirrwijnidfkklmwjpsb' WindowName: 'tkqqreqxbnvfhcylfra'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'ynlzbmapvflrbadmljnjbjlrnpnjiytsmnqest' WindowName: 'ubxkkslpyqhjnutfvzrqo'
ClassName: 'cbrwqswtlxwqdyvijixfpuafocqkjobwurqbghx' WindowName: 'dqbhzupumdxkuwnuqijhospkazsnzdccqcj'
ClassName: 'cezdkrqwholfuqxuucoupuj' WindowName: 'wlkajjryzqpxmhwivltgimzuvzzlkgklhk'
ClassName: 'dgbqdbehnhnkivmkmbhtyvb' WindowName: 'bgdvxejhbziirtursswbjizxiaivhpjhtnsfqjg'
ClassName: 'nvddbiypkjnybttxwmlhybqnykfhhldlpyccmy' WindowName: 'odvdfkxfitgkmtzsghfjjomaykfxeyszmftf'
ClassName: 'wdedonjovhxsvbqj' WindowName: 'mhngmwlgszpqlsjuacbzsj'
ClassName: 'qeuxxntpfaqtoaxisikjxahlawhvm' WindowName: 'dhmhmyachsrupzytgspldcmyemvanyrzsfhhdpg'