high
Summary
Summary
Action- More Information
| Affected operating systems | Windows |
|---|---|
| Characteristics |
|
| Protection available since | 24 May 2005 17:58:06 (GMT) |
| Detected by | All Sophos products |
Free virus scan
- Free virus, spyware, and adware scan
- Test your existing anti-virus protection
- Find threats your anti-virus missed
Action
- Summary
- Action
- More Information
Please follow the instructions for removing Trojans.
More Information
Troj/Banker-CX is a password-stealing Trojan for the Windows platform.
When first run Troj/Banker-CX copies itself to the Windows system folder and creates the following files:
<Windows system folder>\drivers\root\system\ftp.dll
<Windows system folder>\drivers\root\system\install.dll
<Windows system folder>\drivers\root\system\versao.dll
The following registry entry is created to run Troj/Banker-CX on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
NSystem
<original pathname of the Trojan executable>
Troj/Banker-CX displays fake interfaces for certain Brazilian banking websites in order to steal login details. Any details stolen in this manner are uploaded to an FTP server. The hostname, account name and password for this FTP account are specified in a configuration file downloaded from a preconfigured URL.
|
