Troj/BHO-GF is registered as a COM object and Browser Helper Object (BHO) for Microsoft Internet Explorer, creating registry entries under:
HKCR\CLSID\{ba6fd309-5936-8a4d-c47e-0b1874472763}
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ba6fd309-5936-8a4d-c47e-0b1874472763}
The following registry entry is created to run code exported by the Trojan DLL on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
{d136286e-bb98-a38b-4b6b-5433c152de92}
<System>\Rundll32.exe "<pathname of the Trojan DLL>" DllStart