TR/Puper.BA.1 - Trojan

See also

Summary

Full description

Statistics

Virus:	TR/Puper.BA.1
Date discovered:	18/10/2005
Type:	Trojan
In the wild:	No
Reported Infections:	Low
Distribution Potential:	Low
Damage Potential:	Low to medium
Static file:	Yes
File size:	53.248 Bytes
MD5 checksum:	587FACDDFB8D864E0FC85ACF4A87FB11
VDF version:	6.32.00.13 - Fri, 16 Sep 2005 11:53 (GMT+1)

General Method of propagation:
   • No own spreading routine

Aliases:
   • Mcafee: Puper.dll
   • Kaspersky: Trojan.Win32.StartPage.acy
   • Bitdefender: Trojan.Startpage.ACY

Platforms / OS:
   • Windows 95
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows XP
   • Windows 2003

Side effects:
   • Registry modification

Registry It registers a browser helper object (BHO) by adding the following key:

The registered DLL file changes the startpage of Internet Explorer to: http://www.security2k.net
– [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\
   Browser Helper Objects\{FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFA}]
   • @="HP"

The following registry keys are added:

– [HKCR\HP.1]
   • @="HP Class"

– [HKCR\HP.1\CLSID]
   • @="{7297220c-b8c3-438e-9a72-c005d64490b6}"

– [HKCR\HP]
   • @="HP Class"

– [HKCR\HP\CLSID]
   • @="{FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFA}"

– [HKCR\HP\CurVer]
   • @="HP.1"

– [HKCR\CLSID\{FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFA}]
   • @="HP Class"

– [HKCR\CLSID\{FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFA}\InprocServer32]
   • @="%malware dll%"
   • "ThreadingModel"="Apartment"

– [HKCR\CLSID\{FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFA}\ProgID]
   • @="HP.1"

– [HKCR\CLSID\{FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFA}\Programmable]
– [HKCR\CLSID\{FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFA}\TypeLib]
   • @="{7297220c-b8c3-438e-9a72-c005d64490b6}"

– [HKCR\CLSID\{FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFA}\
   VersionIndependentProgID]
   • @="HP"

– [HKCR\TypeLib\{1E1B286C-88FF-11D2-8D96-D7ACAC95951F}\1.0]
   • @="VM HomePage Type Library"

– [HKCR\TypeLib\{1E1B286C-88FF-11D2-8D96-D7ACAC95951F}\1.0\0]
   • @="%malware dll%"

– [HKCR\TypeLib\{1E1B286C-88FF-11D2-8D96-D7ACAC95951F}\1.0\0\win32]
– [HKCR\TypeLib\{1E1B286C-88FF-11D2-8D96-D7ACAC95951F}\1.0\FLAGS]
   • @="0"

– [HKCR\TypeLib\{1E1B286C-88FF-11D2-8D96-D7ACAC95951F}\1.0\HELPDIR]
   • @="%path to malware%"

– [HKCR\Interface\{1E1B2878-88FF-11D2-8D96-D7ACAC95951F}]
   • @="IHomePage"

– [HKCR\Interface\{1E1B2878-88FF-11D2-8D96-D7ACAC95951F}\
   ProxyStubClsid]
   • @="{00020424-0000-0000-C000-000000000046}"

– [HKCR\Interface\{1E1B2878-88FF-11D2-8D96-D7ACAC95951F}\
   ProxyStubClsid32]
   • @="{00020424-0000-0000-C000-000000000046}"

– [HKCR\Interface\{1E1B2878-88FF-11D2-8D96-D7ACAC95951F}\TypeLib]
   • @="{1E1B286C-88FF-11D2-8D96-D7ACAC95951F}"
   • "Version"="1.0"

File details Programming language:
The malware program was written in MS Visual C++.

See a brief description here.

Description inserted by Andrei Gherman on Tue, 18 Oct 2005 17:55 (GMT+1)
Description updated by Andrei Gherman on Thu, 20 Oct 2005 15:39 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back