Troj/Bancos-AE is a password-stealing Trojan related to certain banking websites.
When active, the Trojan logs keypresses when the user accesses certain banking websites. The Trojan contains related images which may be displayed in order to trick the user into entering confidential details. Stolen information may be sent to a remote user by email.
In order to run automatically when Windows starts up the Trojan copies itself to the Windows system folder as REGCXSJAFTP.EXE and creates the following registry entries:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Regcxsjaftp = C:\WINDOWS\SYSTEM32\REGCXSJAFTP.EXE
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
Regcxsjaftp = C:\WINDOWS\SYSTEM32\REGCXSJAFTP.EXE
The Trojan may be dropped by a self-extracting archive as LogWinIE.EXE,
together with two clean files, RICHTX32.OCX and MSWINSCK.OCX.