Troj/Bancos-EL is an Internet banking Trojan which attempts to capture confidential banking information and send it to a remote location.
Troj/Bancos-EL captures and logs text within certain Microsoft Internet Explorer frames.
When first run Troj/Bancos-EL copies itself to <Windows>\windowsxp.exe and creates the following new registry entries:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Service System
"<Windows>\windowsXP.exe"
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Run
Service System
"<Windows>\windowsXP.exe"