high
Summary
Summary
Action- More Information
| Affected operating systems | Windows |
|---|---|
| Characteristics |
|
| Protection available since | 17 January 2006 22:53:56 (GMT) |
| Detected by | All Sophos products |
Free virus scan
- Free virus, spyware, and adware scan
- Test your existing anti-virus protection
- Find threats your anti-virus missed
Action
- Summary
- Action
- More Information
Please follow the instructions for removing Trojans.
More Information
Troj/Puper-BI is a browser hacking Trojan for the Windows platform.
When Troj/Puper-BI is installed the following files are created:
<System>\hhk.dll
<System>\intmon.exe
<System>\hp<random>.tmp
The file hhk.dll is detected as Troj/Puper-V. Intmon.exe and hp<random>.tmp are detected as Troj/Puper-BI.
The file hp23D.tmp is registered as a COM object and Browser Helper Object (BHO) for Microsoft Internet Explorer, creating registry entries under:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ Explorer\Browser Helper Objects\(FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFA)
HKCR\CLSID\VMHomepage\
HKCR\CLSID\(FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFA)
HKCR\HP\
HKCR\Interface\(1E1B2878-88FF-11D2-8D96-D7ACAC95951F)
HKCR\TypeLib\(1E1B286C-88FF-11D2-8D96-D7ACAC95951F)
Registry entries are set as follows:
HKCU\Software\Microsoft\Internet Explorer\Main
Enable Browser Extensions
Yes
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ Explorer\Browser Helper Objecta\(FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFA)\
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ Explorer\Browser Helper Objecta\(FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFA)\(default)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ policies\explorer\run
paint.exe
shnlog.exe
Registry entries are created under:
HKCR\HP.1\
|
