high
Summary
Summary
Action- More Information
| Affected operating systems | Windows |
|---|---|
| Characteristics |
|
| Protection available since | 28 November 2004 17:41:03 (GMT) |
| Detected by | All Sophos products |
Free virus scan
- Free virus, spyware, and adware scan
- Test your existing anti-virus protection
- Find threats your anti-virus missed
Action
- Summary
- Action
- More Information
Please follow the instructions for removing Trojans.
More Information
Troj/Bancban-AI is a password-stealing Trojan related to certain Brazilian banking websites. In particular, the Trojan attempts to steal data relating to the following banks:
Banco do Brasil
Banco Bradesco
Caixa Economica
Banco ITAU
Troj/Bancban-AI runs in the background and monitors the title bar of Internet Explorer for text relating to banking websites. When the user attempts to access such sites, the Trojan is able to display its own user interface, in order to persuade the user to enter banking details. Stolen data is sent by email to a remote user.
In order to run itself on system startup, the Trojan creates the following registry entry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
<Trojan name without file extension>
<Trojan filename including path>
|
