Trojan.StartPage.60414

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nss2.tmp\InetLoad.dll
%TEMP%\nss2.tmp\Math.dll
%TEMP%\nss2.tmp\System.dll

Удаляет следующие файлы:

%TEMP%\nss2.tmp\System.dll
%TEMP%\nss2.tmp\Math.dll
%TEMP%\nss2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'axukzvspemjkpeizrcdrfcistvmpm' WindowName: 'ujrglotmtubeipfmknlnvnmycwldpslggepxx'
ClassName: 'hrrxhlnykamhojqwhyepra' WindowName: 'xovtatbitdnclnxapk'
ClassName: 'ygiqyrvxgrfjmpgpneajzeif' WindowName: 'nytaaxfxioeijhaaecmexnxbsmyrex'
ClassName: 'hdqqxlwiaosvhknpahwqyfn' WindowName: 'hfvuvxwpkwmjqhfqffxnzgvxjsn'
ClassName: 'hnkozrhecrltyyheyydbys' WindowName: 'ccqcqddpctxsxhhka'
ClassName: 'axbejxtoamezlzjndwtqauweqy' WindowName: 'dcekgudndijpjemnqiltucymetcjyfdedx'
ClassName: 'rxpufxltkkdnkkswob' WindowName: 'jbwdmsctmqiicxdwqzdkufnapqjdfbfdgghkgcx'
ClassName: 'rwrbmyoovgknlzjpovnd' WindowName: 'eavmqhiupkjgboqoojscyvfhbccxb'
ClassName: 'zpgdekmjiuxftfphzslhwkwoqwvuozdnjwodrv' WindowName: 'irdzghebqemscfucvxinpmyleeuszzdtqxtz'
ClassName: 'zyipbwmqlijwtyghnosuqdwuoftbjm' WindowName: 'pbllzytcbpcmkqoasyzldnnbsemhmtpjrw'
ClassName: 'dedmpmmbzeqbtpzajfselszvxtvdo' WindowName: 'ajvhpxqtviljjkgoyjnfawgtmaukqyeytk'
ClassName: 'txxlihhohevkvveobqwyndzwruoadpyndypj' WindowName: 'nqkvrgpipdfvtwuybmyzckfvwt'
ClassName: 'rlgpgrybrmiueesxa' WindowName: 'csdalcwjbfvquyyukucnsurvnzxhgp'
ClassName: 'ccinhnbjtywrfodwqkyzvkl' WindowName: 'oykxnjfodtexavywyvv'
ClassName: 'hnhusozgxojizutcddufyfbrmzrcqwl' WindowName: 'svdyhbpjliwghwygjuj'
ClassName: 'xlfzgytlvjnkadv' WindowName: 'lotconbevqxpvkbfvahirkazlharmoicnfo'
ClassName: 'uyezgzvyudsfoegtarlqhknehmo' WindowName: 'uquaswfybekcjtadzgkgvjuzblpykn'
ClassName: 'carqghtcfxvebhvtuaovjrovccsicvjousf' WindowName: 'gjyjkjhmstuuhdkqkjbkfqutgrcfhckqi'
ClassName: 'dxyzfxdptvraicpnqwkhebfui' WindowName: 'nncpgspdokzwtawwwjertfpaahtj'
ClassName: 'sorlcnyogsrujhnvmxjnhepljheapukkv' WindowName: 'moxzwrokbqbyebhowevavskglqfumuoavro'
ClassName: 'sqivtfgfzzwibgxprepricspumvaebbztkxxs' WindowName: 'rsanscysperhtgdlbtkjykninxcaujqbmfuhi'
ClassName: 'fsxvkjqsiyawjdnziukcrrt' WindowName: 'wpijcqrbgtiwjxvugkjiqonuqokyxuyt'
ClassName: 'nmvozybvxcyzurkhedatvizaspqcwkxvodetuh' WindowName: 'orprbimqprdgamddolbvclvfdvrazyxhlivyxn'
ClassName: 'ndofiijllogkozhmwaydzvqlbpe' WindowName: 'demarnxqfbsinrkpat'
ClassName: 'ldpfrtvhzmbomopilzcjois' WindowName: 'nywyirftdgogabpsybdqcbe'
ClassName: 'imdspsbjkdqheefmcevhdgvhtnhayguehosuseg' WindowName: 'gwmxyspuzqvathmmczuo'
ClassName: 'irpzfjuqzezexliebhgyvohospuidaqmmnupc' WindowName: 'idvuwczaxvbxltuaknclslc'
ClassName: 'nrmnncjbktvcrysjosboxopipmgdgeodsz' WindowName: 'gjyypbbuuwrxxkjtykgucecxotpmzagwgjgn'
ClassName: 'zhfmgtukrjcdbziqpgc' WindowName: 'kjqfhdbqxvumoiwshxwppz'
ClassName: 'ixxkkytbrqisewgownzr' WindowName: 'nkrlsikfgwxbolocswe'
ClassName: 'rlclhkhfgrvdrmoakxusifem' WindowName: 'pzemtmfynfordxifwxbov'
ClassName: 'uwberwiiepxlpgljvyzr' WindowName: 'pkxwvoyusdmvfuhdnyjrydatemx'
ClassName: 'hgehjocfcipqjhklidaxp' WindowName: 'tebfzqrtnxfhwdoilemstazmbselcdpidipm'
ClassName: 'lpcgunuleyqhbxynxyurbtcldpsyubriphxsqcz' WindowName: 'mohpgnqqnngnibfwy'
ClassName: 'ofmlkboqovykgqeiffwdehj' WindowName: 'hszpdumulsirnizjnvnpoxahdiu'
ClassName: 'uzdajyqexuwjgsbrwzmcvldbonbzlmcfzf' WindowName: 'sziuaielubyaqkwjbd'
ClassName: 'rzedbptxydvhtszckzq' WindowName: 'bcwjkzhwwocdvelwkymppixkxknsxos'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'qnsxwbijfogicvpbdfdrjnmpazjsrc' WindowName: 'quoesseaqbmrkdkdrtqvibdjiqpwoesgcda'
ClassName: 'ifullgpzfxmerrbzvxgq' WindowName: 'etfehujkcrrkjxetuswinwcklcfuinb'
ClassName: 'niuqempfdizsloskkvzqzgletffovivem' WindowName: 'dhdvgskyuywluqdxndfes'
ClassName: 'fuuywzrqpkltuepxkxzcyhwmif' WindowName: 'ujpvvdfpzdmuzdajfyynfctkeyp'
ClassName: 'dunfriiaakzskuizz' WindowName: 'ouipdfxdlqktjvkjlocd'
ClassName: 'gmzocswopuoxacblsjysgbpkwzidqmlmzfbi' WindowName: 'trynlqzeqvnmgewdsivwhc'
ClassName: 'hniicfxvwulniomtfiehrdsswqvmrmgczewow' WindowName: 'pcyfqygacjqolhokiutndbilnaqurz'
ClassName: 'lgaigxlosenuwribsdgvxkmmxsghpyjcjwatvr' WindowName: 'tvprekprznkctjvekywtnmxevjjiqii'