Troj/Banker-DLD is a Trojan for the Windows platform.
Troj/Banker-DLD monitors the user's internet access and steals on-line banking details. The Trojan also attempts to block access to anti-virus and security related websites.
When Troj/Banker-DLD is installed the following files are created:
<Windows system folder>\agpbrdg0.dll
<Windows system folder>\agpbrdg5.sys
<Windows system folder>\ksl48.bin
The file agpbrdg5.sys is detected as Troj/Haxdor-Gen.
The following registry entries are created to run code exported by agpbrdg0.dll on startup:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\agpbrdg0
DllName
agpbrdg0.dll
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\agpbrdg0
Startup
agpbrdg0
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\agpbrdg0
Impersonate
1