Troj/Bankgerm-D is a password-stealing Trojan for the Windows platform.
When Troj/Bankgerm-D is installed it creates a file in the Windows folder with a randomly generated name. This file is also detected as Troj/Bankgerm-D.
The following registry entry is created to run hijsrv.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HijSrv32
<Windows>\hijsrv.exe
The following registry entries are set, affecting internet security:
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
1609
0
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
1609
0
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
1609
0
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
1609
0
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4
1609
0
Registry entries are set as follows:
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings
WarnOnPostRedirect
0
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings
WarnOnZoneCrossing
0