Troj/Bancban-CY is a Trojan for the Windows platform.
Troj/Bancban-CY steals confidential information relating to certain online banking applications by displaying fake login screens and sends stolen information to a remote user.
Troj/Bancban-CY sends an email notification to a remote user when the computer is first infected.
When first run Troj/Bancban-CY copies itself to <System>\svchost.scr.
The following registry entry is created to run svchost.scr on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
<random>
<System>\svchost.scr