high
Summary
Summary
Action- More Information
| Affected operating systems | Windows |
|---|---|
| Characteristics |
|
| Included in our products from | November 2006 (4.11) |
| Protection available since | 15 September 2006 05:37:10 (GMT) |
| Detected by | All Sophos products |
Action
- Summary
- Action
- More Information
Please follow the instructions for removing Trojans.
More Information
Troj/Banworm-H is a Trojan for the Windows platform.
Troj/Banworm-H includes functionality to:
- access the internet and communicate with a remote server via HTTP
- steal information
Troj/Banworm-H may modify the HOSTS file which maps the URLs of selected websites to a loopback IP address or to its own IP addresses, in order to prevent access to certain sites and to control/hijack browsing. By this technique Troj/Banworm-H tries to block access to several security related sites and hijack a number of banking related sites.
When Troj/Banworm-H is installed the following files are created:
<Windows>\tmp.log
<Windows>\uid.id
These files can be safely removed.
Registry entries are set as follows:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32net
DllName
crypt32net.dll
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32net
Logon
ChainWlxLogoffEvent
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32net
Asynchronous
1
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32net
Impersonate
0
|
