Troj/Puper-D is a browser hacking Trojan for the Windows platform.
When Troj/Puper-D is installed the following files are created:
<System>\hhk.dll
<System>\intmon.exe
<System>\hpXX.tmp - where XX denotes randomly generated characters.
Sophos Anti-Virus will detect each of these files as Troj/Puper-D, in addition to detecting the main file shnlog.exe.
In order to run itself on startup, the Trojan creates the following registry entry:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run
paint.exe
shnlog.exe
Furthermore, intmon.exe monitors the main process, and restarts it if it is terminated. Meanwhile the main process restarts the monitoring process if it is terminated, and recreates the file intmon.exe if it is deleted.
Troj/Puper-D changes settings for Microsoft Internet Explorer, including Start Page and search settings, by modifying values under:
HKCU\Software\Microsoft\Internet Explorer\Main
HKCU\Software\Microsoft\Internet Explorer\Main\Default_Page_URL
HKCU\Software\Microsoft\Internet Explorer\Main\Default_Search_URL
HKCU\Software\Microsoft\Internet Explorer\Search
HKCU\Software\Microsoft\Internet Explorer\Main\Search Page
HKCU\Software\Microsoft\Internet Explorer\Main\Start Page
HKCU\Software\Microsoft\Internet Explorer\SearchUrl
Registry entries are set as follows:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objecta\(FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFA)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objecta\(FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFA)\(default)
Registry entries are also created under:
HKCR\CLSID\VMHomepage\
HKCR\CLSID\VMHomepage.1\
HKCR\VMHomepage.1\
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_FASTUSERSWITCHINGCOMPATIBILITY\0000\Control\
HKLM\SYSTEM\CurrentControlSet\Enum\Root \LEGACY_NETMAN\0000\Control\
HKLM\SYSTEM\CurrentControlSet\Enum\Root \LEGACY_NLA\0000\Control\
HKLM\SYSTEM\CurrentControlSet\Enum\Root \LEGACY_RASMAN\0000\Control\
HKLM\SYSTEM\CurrentControlSet\Enum\Root \LEGACY_SSDPSRV\0000\Control\
HKLM\SYSTEM\CurrentControlSet\Enum\Root \LEGACY_TAPISRV\0000\Control\
HKLM\SYSTEM\CurrentControlSet\Enum\Root \LEGACY_TERMSERVICE\0000\Control\
The file hpXX.tmp is registered as a COM object and Browser Helper Object (BHO) for Microsoft Internet Explorer, creating registry entries under:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\(FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFA)
HKCR\CLSID\VMHomepage
HKCR\CLSID\(FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFA)
HKCR\Interface\(1E1B2878-88FF-11D2-8D96-D7ACAC95951F)
HKCR\TypeLib\(1E1B286C-88FF-11D2-8D96-D7ACAC95951F)
HKCR\VMHomepage