Troj/Bankhof-E is a password stealing Trojan for the Windows platform.
When Troj/Bankhof-E is installed the following files are created:
<System>\rdrlib.dll
<System>\msctr.dll
msctr.dll is detected as Troj/Bankhof-D.
The following registry entry is created to run code exported by OLE Module on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ SharedTaskScheduler
(0C81EA61-20F8-4DDC-81BF-AF0923078398)
Automation Object
The following registry entry is set:
HKCU\Software\Classes\CLSID\(0C81EA61-20F8-4DDC-81BF-AF0923078398)\ InProcServer32
(default)
<System>\msctr.dll
Registry entries are created under:
HKCU\Software\Classes\CLSID\(0C81EA61-20F8-4DDC-81BF-AF0923078398)\ InProcServer32\