Troj/Banker-EHG is a Trojan for the Windows platform.
When run, the Trojan copies itself to:
<Startup>\remote.cmd
<System>\java.cmd
<System>\remote.cmd
The following registry entries are created to run remote.cmd on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
hotdlll
<System>\remote.cmd
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
java
<System>\remote.cmd