Trojan.StartPage.59875

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsg2.tmp\InetLoad.dll
%TEMP%\nsg2.tmp\Math.dll
%TEMP%\nsg2.tmp\System.dll

Удаляет следующие файлы:

%TEMP%\nsg2.tmp\System.dll
%TEMP%\nsg2.tmp\Math.dll
%TEMP%\nsg2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'myfxzbrfssgymzvvzyuskenunthidwjbltlti' WindowName: 'hxvjduzfmzojgevrqxumltdlm'
ClassName: 'ifpvwdkdgahjjlctfzg' WindowName: 'rspwmngntbikwxepaufvvlqdokbmpegdcnhfycx'
ClassName: 'qeqjdglrkboyvqfztpbucvcs' WindowName: 'kifffkxfnnzzakkkpahsvagbmybz'
ClassName: 'txrphsvwqagvavfrhzpjvkqpsjcgixrdlfb' WindowName: 'ndyqgkpwyxgdqohnecthirufknrmeyvisijolt'
ClassName: 'jjbenfmshldbdqspze' WindowName: 'qwscssfpiyapysqpgmcgzrhbpcexnvekfuia'
ClassName: 'fxjsgnbtrqfwokgzdpkficky' WindowName: 'ljzmfvozckfayuv'
ClassName: 'cirdfhgvifddrynnkhrnrbqpcejxlwjlnty' WindowName: 'aohrsiprkwcoufq'
ClassName: 'yxzmakhtxhpozrga' WindowName: 'vnwcieadhcccnxcoqddpksiuzmqjntfjuab'
ClassName: 'zhkheebvwnbjfcmhovmnhvfcmkxtfkdodszx' WindowName: 'fuugvyrhoinidwcmdfeumahubdqtgjvkxz'
ClassName: 'mvpsukxdcvcerlwxbdkefidzczqqcsiu' WindowName: 'jokimuqdclunaapwdcfu'
ClassName: 'blpwggbwskssdzirzbfutkfwqr' WindowName: 'ejovtvwzvhshhgvlvyixplrocrgton'
ClassName: 'qdoplqiudtqftkwjradsjabjaqc' WindowName: 'ebhpmaiusvhqfgouhv'
ClassName: 'mbclrvsezfhhhthkgutfihwhsd' WindowName: 'smzsnrwulvalgjwkgpnmxpbpjazycommrr'
ClassName: 'hqwpqenwjilzaeedl' WindowName: 'vhsegvzfnjvwrhlygznwuy'
ClassName: 'kddpfihdexbnfnraeiaqgxgah' WindowName: 'tfcxtltahytohhqwpcwuqcjyuquvui'
ClassName: 'kpdgwbpponmvubyykcngebvrnqcpjmhkzzi' WindowName: 'wgrxegmublgccqykldmxrrbnkkn'
ClassName: 'fpjnanewddxdrukh' WindowName: 'wysmdoarptjdbxqiyjasdrgzjwkwjuu'
ClassName: 'bvlzbruxclabjtvlcbszlownhbgpvdt' WindowName: 'wuyanozeepicqlznzypeetjdtvfgt'
ClassName: 'numawuasfymkvdyaldsoavtetuvlkaqcd' WindowName: 'euuxthzrnaldskcjqbuidocajrl'
ClassName: 'txexvoebcdqdxzhuvwwar' WindowName: 'hzdxvhknpybfcwppxxryugfe'
ClassName: 'tufjcalpckiwykvlc' WindowName: 'hkydvlhlnfsxdlyoxjhjundvurion'
ClassName: 'vbidbxlfaevbhglybeumhgtfdokwiloqg' WindowName: 'mlmlgqktipdgmwyifvisjpq'
ClassName: 'zfnambftcksmbhpgvmfmcvlninmne' WindowName: 'ktuhaiufsrsdomdvmgffwjlddoa'
ClassName: 'dndkzziyzowwwbjstqznuxm' WindowName: 'sxhahxrjczysnoqkmuke'
ClassName: 'lrxbypagdtraotkuwwuaqzcdhyrfafxtbbnykq' WindowName: 'bxqmmmakucliyudjhdyjbhhlzdhudcqgxxaygqc'
ClassName: 'nachhbkfmftitwxcppbemznsxwsirmirbglh' WindowName: 'tvkthuafgwldbdnxhakuewhpcfguhyhtv'
ClassName: 'abkiwxdiurfxalbmnqxgew' WindowName: 'ctmjncimfknapkpjwmtlqpfohildghxjq'
ClassName: 'czrmeiglmobhowrbusjlpvfxgq' WindowName: 'fcpqrocqcjtahvodmbqnjgickwjkfdhfz'
ClassName: 'wjwdnecrmuexahwyakuar' WindowName: 'brutuspmmyjvqnzrpxynxhmhyslrzdzuh'
ClassName: 'lpbsscgxnirtnlgqhdd' WindowName: 'sqiuavkestivkwwmhwgrbwumjggoxfuchohwpiq'
ClassName: 'kktrqwaebtadohudtypuoo' WindowName: 'tzsqwvtjxfvntbhkemmdeqovm'
ClassName: 'vfweahiangqdkbbrmljveshiwf' WindowName: 'muwbuolmzrudfchnowvhqni'
ClassName: 'ebulhzbpsxotuqzmzojkcme' WindowName: 'uocuviskncbqgqhg'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'yuavshdzipwmlslguihjchbahwazvadnqqo' WindowName: 'yjcipmyhosienxzrzjbtvsaygrejmw'
ClassName: 'awyutrflanwdmwfacb' WindowName: 'yqvulydjdmuagojeelqegkqodqdi'
ClassName: 'geykqdaoaqgqeuczirbnfzubcm' WindowName: 'abqwykkxzfcvlygdbmcfjs'
ClassName: 'caueuycaggnnjzjomj' WindowName: 'ntgaqkqmlssyxprrbbwiexyvoy'
ClassName: 'ihprqjmgfwvzrkdxjdkgndjywse' WindowName: 'yqqjofpbnvwwnqgxwuhwtzvtwngyosrxibyqn'
ClassName: 'jjyesneibekwlpkkuazdu' WindowName: 'xvcooifmrbevadeiphharhshcozdisrlb'
ClassName: 'nhqmailpuumaymqsrjvfkaeyu' WindowName: 'kyogmrhazvmwrqpqlga'
ClassName: 'uupauzwjrkdpyzzhjtvrceortoxkvbyvjzspx' WindowName: 'squsjnbtzwjlulczdtezxj'