Troj/Bancban-ET is a password-stealing Trojan for the Windows platform.
When first run Troj/Bancban-ET copies itself to <System>\Central de Segurança\csrss.exe.
The following registry entry is created to run csrss.exe on startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Console de Gerenciamento Microsoft
<System>\Central de Segurança\csrss.exe
Registry entries are created under:
HKLM\SOFTWARE\Sos\Validade\