Troj/Puper-BI is a browser hacking Trojan for the Windows platform.
When Troj/Puper-BI is installed the following files are created:
<System>\hhk.dll
<System>\intmon.exe
<System>\hp<random>.tmp
The file hhk.dll is detected as Troj/Puper-V. Intmon.exe and hp<random>.tmp are detected as Troj/Puper-BI.
The file hp23D.tmp is registered as a COM object and Browser Helper Object (BHO) for Microsoft Internet Explorer, creating registry entries under:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ Explorer\Browser Helper Objects\(FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFA)
HKCR\CLSID\VMHomepage\
HKCR\CLSID\(FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFA)
HKCR\HP\
HKCR\Interface\(1E1B2878-88FF-11D2-8D96-D7ACAC95951F)
HKCR\TypeLib\(1E1B286C-88FF-11D2-8D96-D7ACAC95951F)
Registry entries are set as follows:
HKCU\Software\Microsoft\Internet Explorer\Main
Enable Browser Extensions
Yes
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ Explorer\Browser Helper Objecta\(FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFA)\
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ Explorer\Browser Helper Objecta\(FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFA)\(default)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ policies\explorer\run
paint.exe
shnlog.exe
Registry entries are created under:
HKCR\HP.1\