Troj/Banker-BO

Please follow the instructions for removing Trojans.

Change any data that may have become compromised.

Windows NT/2000/XP/2003

In Windows NT/2000/XP/2003 you will also need to edit the following registry entry. The removal of this entry is optional in Windows 95/98/Me. Please read the warning about editing the registry.

At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE entry:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
hostdll.exe
hostdll.exe

and delete it if it exists.

Close the registry editor.

Troj/Banker-BO is a password stealing Trojan for the Windows platform that
targets particular online banking sites.

Once executed Troj/Banker-BO copies itself to the Windows folder with the
filename hostdll.exe, and in order to be able to run automatically when
Windows starts up sets the regsitry entry:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
hostdll.exe
hostdll.exe

Running in the background Troj/Banker-BO monitors a user's internet access
to the following banking websites in attempt to log user activity and send the
stolen details to a predefined remote location:

a-bank.co.jp
aaadir.com
abb-bvb.be
abbeynational.co.uk
abbeynational.it
abnamro.ca
abnamro.com
accbank.ie
accessanb.com
adabank.com.tr
adamandcompany.plc.uk
adb.org
adelaidebank.com.au
aegon.be
agn.gr
agricol.ad
agrolink.moa.my
aib.ie
aigprivatebank.com
aimfunds.ca
all.rokin.or.jp
allfirst.com
ambg.com.my
amp.com.au
amsouth.com
anbtx.com
angloirishbank.ie
ankerbank.ch
anz.com.au
arjil-associes.com
atb.com
ate.gr
avco.se
baca.sk
banamex.com
bancadelsalento.it
bancagenerali.it
bancamarch.co.uk
bancamediolanum.it
bancboscap.com
bancnet.net
bancodisicilia.it
bancomext-mtl.com
banesto.es
bank-corner.de
bank-ir.ne.jp
bank.lu
bank1.netbanking.ch
banka.hr
bankaustria.com
bankenverband.li
bankers.asn.au
bankfacts.org.uk
bankgesellschaft.de
banking.halifax-online.co.uk
banking.hsbc.co.uk
bankofamerica.com
bankofamerica.com.hk
bankofcanada.ca
bankofchina.com
bankofcyprus.com
bankofengland.co.uk
bankofgreece.gr
bankofireland-ni.com
bankofireland.co.uk
bankofireland.com
bankofireland.ie
bankofny.com
bankofscotland.co.uk
bankone.com
banksa.com.au
banksys.be
banktip.de
bankwest.com.au
banque-diamantaire.com
banque-france.fr
banque-hervet.fr
banque-piguet.ch
banquedebaecquebeau.fr
banquedevizille.fr
barclays.co.uk
barclays.gr
bayernlb.de
bbk.es
bbl.be
bcee.lu
bcme.fr
bcmn.fr
bcv.ch
bde.es
bekbnet.ch
belgolaise.com
bendigobank.com.au
bes.pt
bgl.lu
bh.com.pl
bi.is
bia.lu
bibm.ad
bicf.ie
bipop.it
bmo.com
bnb.be
bnc.ca
bng.nl
bnl.it
bnpparibas.com.hk
bob.bankwest.com.au/BWAMain.htm
boiusa.com
boy.co.jp
bpci.it
bpm.it
bpn.it
bportugal.pt
bsi.ch
bsk.com.pl
bsn.com.my
bstdb.gr
btm.co.jp
btp-banque.fr
bundesbank.de
bve.li
ca-indosuez.com
caixabank.ad:8090
canajocnb.com
capitalstage.com
carifirenze.it
cariparo.it
carnegie.lu
cbksec.com
ccbonline.com
centralbank.net
centralnational.com
centura.com
chase.com
chevychasebank.com
chugin.co.jp
church-house.co.uk
cibc-global.com
cibcopco.com
cibcwm.com
cimbanque.ch
citibank.co.uk
citibank.com.au
citizensbank.com
clariden.com
clearstream.com
close.co.im
cmutuel.com
cnb.cz
co-operativebank.co.uk
cobepa.be
coletaylor.com
colonial.com.au
commbank.com.au
commbankuk.com
commerceonline.com
commerzbank.com
communitysavings.ca
cortal.lu
cpbi.com
credit-suisse.ch
credit.it
creditandorra.com
creditanstalt.co.at
creditbase.it
creditcardhut.com
cspb.com
cwbank.com
dahsing.com.hk
danskebank.com
danskebank.dk
daoheng.com
darierhentsch.ch
defcredit.com.au
depfa.de
deutsche-bank.de
dexia.ch
dresdner-bank.com
ducroire.be
dzbank.de
e-gold.com
ebank.hsbc.co.uk
ebanking.com
ebankinter.com
ebs.ie
eco-bank.com
ellada.net
empirepoker.com
essenhyp.de
ethniki.gr
eubfn.com
eurofin.fr
fhlbdm.com
firstactive.ie
firstcalgary.com
firstunion.com
firstusa.com
fitd.it
fleet.com
fnbchix.com
foncier-international.com
fortisbank.com
fr.fortisbank.com
fr.qualisteam.com
frbsf.org
fxdealing.cibc.com
garantibank.com.tr
genevesuisse.com
google.netscape.com
greateasternbank-ny.com
grindlays.com
hdb.co.uk
helaba.de
hifl.demon.co.uk
hkbc.com
hkbea.com
hkexporter.net
homebank.nbg.gr
hottinger.com
household.com
hsbc.
hsbc.ca
hsbctrinkaus.de
hwag.de
hyakugo.co.jp
ib.national.com.au
iba.com.hk
ibank.barclays.co.uk
ibank.barclays.co.uk
ibank.barclays.co.uk
ibank.stgeorge.com.au
icc.ie
ikb.de
imb.com.au
imiweb.net
info-on-banking.com
info.gov.hk
invesnet.com
irish-nationwide.com
isbank.com.tr
isbank.is
iyobank.co.jp
jbpb.com
jhb.co.uk
jobsatthebank.co.uk
jpmorgan.com
juliusbaer.com
jyskebank.dk
kas-associatie.com
kempen.nl
key.com
keytrade.com
koba.cz
kredytbank.com.pl
ksklb.de
lasallebank.com
lcf-rothschild.fr
leasepac.com.au
leleux.be
leonia.fi
leu.com
lgt.com
link.co.uk
llb.li
lloydstsb.co.uk
lloydstsb.com
london-scottish.com
lrp.de
ltsbprivatebanking.co.uk
macquarie.com.au
main.hangseng.com
mandtbank.com
maxmtg.com
maybank2u.com
mb.hr
mbna.com
mcb-bank.com
mellon.com
merita.fi
metrobank.com.ph
mfb.hu
MidAmericaBank.com
MidAmericaBank.com
midwestcu.org
mitsubishi-trust.co.jp
mkb.hu
mnb.hu
mngbank.com.tr
mortonmanagement.com
mps.it
myonlineaccounts2.abbeynational.co.uk
national.com.au
nationalbanksupply.com
natwest.com
nbfinancial.com
nboc.com
nbp.pl
newcastlepermanent.com.au
nordea.se
nordlb.de
nxbp.fr
ocbc.com.my
olb.westpac.com.au
olb2.nationet.com
olb2.nationet.com
onbanca.it
online.lloydstsb.co.uk
osuuspankki.fi
otpbank.hu
pamukbank.com
partypoker.com
pb.grindlays.com
pekao.com.pl
penny.net
pictet.com
pncbank.com
popolarebari.it
portal.lacaixa.es
portalino.it
preschoicefinancial.com
puilaetco.be
rabobank.com
rbs.co.uk
rbsmarkets.com
rhbbank.com
rivaygarcia.es
riversidebank.net
rodos.com
rolobanca.it
romagnaest.it
rothschild.lu
sabanci-bank.co.uk
sbbgroup.com.my
scotiabank.com
scsalliance.com
sedlabanki.is
sella.it
shacombank.com.hk
shared-interest.com
shiawase.co.jp
slaviacapital.com
socgen.com
solbankspain.com
spar.is
sparkasse.at
sparnordbank.com
sphere.ne.jp
splitskabanka.hr
spron.is
standardbank.com
standardchartered.com
standardchartered.com.hk
statebank.com
statecentralbank.com
stgeorge.com.au
sumitomotrust.co.jp
sunbank.co.uk
suncorpmetway.com.au
suntrust.com
swiftcopters.ch
takasbank.com.tr
tatrabanka.sk
tcmb.gov.tr
tdcanadatrust.com
techdatasys.com
towabank.co.jp
treasury.boi.ie
triodos.co.uk
ubp.ch
ubs.com
ucpb.com
ukpersonal.hsbc.co.uk
ulsterbank.com
unibank.dk
unicredito.ie
usbank.com
utbank.co.uk
vb-medebach.de
visureinrete.it
volksbank-karlsruhe.de
volksbank.li
vpbank.li
vwd.de
w3.luba.sk
wachovia.com
wallstreetbankingcorp.com
wellsfargo.com
westlb.com
westpac.com.au
whbhk.com
winglungbank.com.hk
woodrow.mpls.frb.fed.us
woolwich.co.uk
worldbank.hr
www.anz.com
www.bendigobank.com.au
Www.boq.com.au
www.citibank.com.au
www.ebank.hsbc.co.uk
www.iblogin.com
www.natwest.com
www.ukpersonal.hsbc.co.uk
www2.netbank.commbank.com.au
ykb.com
zaba.hr
ziba.cz

Troj/Banker-BO steals confidentional information including following:

INETCOMM Server Passwords
MS IE FTP Passwords
Outlook Account Manager Passwords
Email account details for HTTP, IMAP and POP3 accounts
Cached Internet Explorer FTP passwords

Also Troj/Banker-BO attempts to download and run file from a certain URL.