high
Summary
Summary
Action- More Information
| Affected operating systems | Windows |
|---|---|
| Characteristics |
|
| Protection available since | 23 October 2004 11:26:23 (GMT) |
| Last updated | 13 May 2005 09:34:31 (GMT) |
| Detected by | All Sophos products |
Sophos beta program
- Endpoint Security and Control 9.0
- Small business solutions 4.0
Action
- Summary
- Action
- More Information
Please follow the instructions for removing Trojans.
More Information
Troj/Bancos-AE is a password-stealing Trojan related to certain banking websites.
When active, the Trojan logs keypresses when the user accesses certain banking websites. The Trojan contains related images which may be displayed in order to trick the user into entering confidential details. Stolen information may be sent to a remote user by email.
In order to run automatically when Windows starts up the Trojan copies itself to the Windows system folder as REGCXSJAFTP.EXE and creates the following registry entries:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Regcxsjaftp = C:\WINDOWS\SYSTEM32\REGCXSJAFTP.EXE
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
Regcxsjaftp = C:\WINDOWS\SYSTEM32\REGCXSJAFTP.EXE
The Trojan may be dropped by a self-extracting archive as LogWinIE.EXE,
together with two clean files, RICHTX32.OCX and MSWINSCK.OCX.
|
