Trojan.StartPage.60081

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsb2.tmp\InetLoad.dll
%TEMP%\nsb2.tmp\NSISdl.dll
%TEMP%\nsb2.tmp\System.dll
%TEMP%\nsb2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsb2.tmp\NSISdl.dll
%TEMP%\nsb2.tmp\System.dll
%TEMP%\nsb2.tmp\InetLoad.dll
%TEMP%\nsb2.tmp\Math.dll

Сетевая активность:

Подключается к:

'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'bmcwhlfrnqqsdsyncxvbvbnhihedpc' WindowName: 'glbaoyzdzjltzhhdqcsyki'
ClassName: 'qzfknnxxsimdcnusy' WindowName: 'vkbyucbzanohdualysylcgrfzk'
ClassName: 'zikwvpiincmeejk' WindowName: 'uqwrnyzfhostvybbsowllckliqozhieirkbahe'
ClassName: 'sscojfndgthemnfcigdofexsvne' WindowName: 'olpdjqyovqmiiicgjjiwnsljkzracg'
ClassName: 'kjqxjaajulircsurwsoc' WindowName: 'lfefpwxuoazxnopgvpckrdvhtkbmhudzgtbnkl'
ClassName: 'fifobhvumewpmorgzpwsqlqztsisahrlhhdbfor' WindowName: 'tkiipxkjexazwkirdzpynkggydh'
ClassName: 'kqghqhyllqafrgllzaevourffw' WindowName: 'cscuzdbjrzyihcetotvlijo'
ClassName: 'hyssgkzivklhpccpuxs' WindowName: 'jumopiyohkmycro'
ClassName: 'csmubmdtbpkbhdocnkjmljgvd' WindowName: 'tzpkmdxilymoiyhrywyhhvjmqrvq'
ClassName: 'maorskmdsasdugguarhuaj' WindowName: 'cytfimjyavxuxhrymcpwyqycrrpuruwcljkoro'
ClassName: 'ynqqqicvmyjlbgzsehagvhmzdpm' WindowName: 'ysxlsbogwahgwopiteuhffdompd'
ClassName: 'xgbomeutlymesiwsixezbodhavonhslyrlljvvh' WindowName: 'ijkcyitlorcdyzjsudzknocsesr'
ClassName: 'kjkplpgpmfawsagjb' WindowName: 'rdqcpzztihgmlztrgswriabrpwwvlkm'
ClassName: 'ycdavgztdwmpglgxejemoumi' WindowName: 'dsdtcznqyiwclmwwtfnnazblosz'
ClassName: 'bujarrbfybqjsxyvewz' WindowName: 'nqjnnxoxippcjhotadsnf'
ClassName: 'bextcwhyzriienqwetqaui' WindowName: 'ttvqtxvhrinjbhd'
ClassName: 'qasqjurywfqnfopcrqrzcyoloucekzvnrqk' WindowName: 'eqmefdqdbzjzpnzukqhb'
ClassName: 'ihzsyiunsakcabulwkzmtlebrm' WindowName: 'ccentodpjfpoegjj'
ClassName: 'ybxqzkbdjdtlltvxxmaadnszfiqhmyfqztzhht' WindowName: 'xhgctdbyjmplbjlystaconcuhco'
ClassName: 'apjprxovhkgjbxjczxlxbopyof' WindowName: 'damcfmtmdrripkyiuryje'
ClassName: 'bryvkoryiecefkjjlpxcufgndxoypbean' WindowName: 'lztriltujypexgrjfipxjyayxeriqznxtjqwwa'
ClassName: 'rrrotjrqdjczvgdszqyhngb' WindowName: 'ygmumvsxwflmzlfgutgdgorwmuqgfqnxzfkfyll'
ClassName: 'pqzbaanmxofkhfwymj' WindowName: 'lkzbxayycbkrprvwrrohrybehnsywkkozwyii'
ClassName: 'vnsnsikmqgjxdgaivspgdwzeocsiqaa' WindowName: 'umaleamufdvjgwwfsxwylcfgkepmvqyifuocecl'
ClassName: 'lxptctzgfwzvcxxawalehqbqwajfsq' WindowName: 'fkhwwtaxaqxmkhihqzkhftjlppxhlvlxaoa'
ClassName: 'fxvelctmnarsqbzllotfiyytr' WindowName: 'rwfigvbjxbjcmzlkirsfxbzcewjtql'
ClassName: 'khgpgpmavrpajqrrifdlrcufneej' WindowName: 'jjcefbrwsezsukvjdjrfbo'
ClassName: 'wxdwneyvnaqebdfcdqognanocriic' WindowName: 'vqtmtwijjlcpvckvzlewogaowgstohhhol'
ClassName: 'mszeqmfajoilowukwvlawoeoindnxwgcc' WindowName: 'ybqxbhvtixezqvddguqgcjwrpxyvm'
ClassName: 'kcurgubwtyewpulz' WindowName: 'pmuenvnipiesusfzbrwslihxkewouukcmz'
ClassName: 'umiozhmivainiepnjmwdbjaviuxmtnk' WindowName: 'iilbvfsabpkwdrllfjnpqvodri'
ClassName: 'oqgytsidakbmprksnimdrocsyilyvkqcemfq' WindowName: 'zeztpeahpqxyfgwodfmymkmasguudrrhzf'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'owvtikegvbdmfkvzuvraeiu' WindowName: 'gtfazzfrtnxygredrqoxvpysbrkhzerxapeksb'
ClassName: 'mlmbjjzfoiuwlrro' WindowName: 'gnndlgcvcyzullewxgozem'
ClassName: 'anlcublvrijobuacsdynvlgxznuc' WindowName: 'tvuyltpcxbycrdqckqtxsa'
ClassName: 'rjtpjfegvzheagmiwdoikvvswjpupaxvksvex' WindowName: 'eaeilteutjcxstqv'
ClassName: 'zoegylgiuvxzbsynsdfcizhlmag' WindowName: 'jfpypzvzuofpygltek'
ClassName: 'bbdbyjqnwbiqvinirowsmxyscarljxuu' WindowName: 'mbijlnkewxoehtjlv'
ClassName: 'mkmhtotsskoaxeevivlzslmhdmmqqgnjqm' WindowName: 'zqfppjmwmsitnojlsm'
ClassName: 'eggjxbotfxyqzpnhfbkftxlxjrgsiaezlfum' WindowName: 'sjdnmrnplnoqcgfnigrlwsxqcicyuimugdaoh'