Troj/Delf-PB is a Trojan for the Windows platform.
The Trojan contains functionality to drop more malware and access the Internet.
When Troj/Delf-PB is installed the following files are created:
<System>\birdihuy.dll
<System>\birdihuy32.dll
<System>\exeha2.exe
<System>\exeha3.exe
Birdihuy.dll is a harmless data file. Birdihuy32.dll and exeha2.exe are detected as Troj/Delf-PB. Exeha3.exe is detected by Sophos's anti-virus products as Troj/Krepper-W.
Troj/Delf-PB changes settings for Microsoft Internet Explorer by modifying values under:
HKCU\Software\Microsoft\Internet Explorer\Security\
The following registry entry is set:
HKCU\Software\Classes\CLSID\ (F33812FB-F35C-4674-90F6-FD757C419C51)\InProcServer32
(default)
<System>\birdihuy32.dll
Registry entries are created under:
HKCU\Software\Classes\CLSID\ (F33812FB-F35C-4674-90F6-FD757C419C51)\InProcServer32\