Troj/Banker-FZ is a password stealing Trojan for the Windows platform.
Troj/Banker-FZ targets the customers of certain Brazilian online banking websites, by logging any keystrokes entered into any forms at those websites as well as creating screen grabs.
When first run Troj/Banker-FZ copies itself to <Windows>\wscntfy.exe.
The following registry entry is created to run wscntfy.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
KAVPersonal90
<Windows>\wscntfy.exe /nosplash