Troj/Banker-DS is a password-stealing Trojan targeted at users of Brazilian online banks.
Troj/Banker-DS attempts to log keypresses entered into certain online banking applications. The Trojan may display fake user interfaces in order to trick the user to enter confidential details. Stolen information is sent by email to a remote user.
Troj/Banker-DS creates the following registry entry in order to run automatically on computer logon:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
WinXP-98
C:\Arquivos de programas\WinXP-98\Tools\CSRSS.exe