Troj/Bancos-DD is an internet banking Trojan.
Troj/Bancos-DD includes functionality to silently download, install and run new software.
When first run Troj/Bancos-DD copies itself to <Windows>\smss.exe.
The following registry entry is created to run smss.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
zsmss
<Windows>\smss.exe