high
Summary
Summary
Action- More Information
| Affected operating systems | Windows |
|---|---|
| Characteristics |
|
| Protection available since | 23 June 2008 05:41:04 (GMT) |
| Detected by | All Sophos products |
Sophos beta program
- Endpoint Security and Control 9.0
- Small business solutions 4.0
Action
- Summary
- Action
- More Information
Please follow the instructions for removing Trojans.
More Information
Troj/Banker-EMB is a Trojan for the Windows platform.
When Troj/Banker-EMB is installed the following files are created:
<System>\helper.xml - can be safely removed.
<System>\mstrans.dll - has been detected as Mal/NetHelDl-A.
The file mstrans.dll is registered as a COM object and Browser Helper Object (BHO) for Microsoft Internet Explorer, creating registry entries under:
HKCR\CLSID\{850C7964-9320-4055-BE11-7D7B562A6417}
HKCR\Interface\{75490F78-6E20-45A1-90BF-4D69D5E8BFA2}
HKCR\TypeLib\{C762C303-ADB0-4F4B-BBAA-D037694D3590}
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{850C7964-9320-4055-BE11-7D7B562A6417}
Registry entries are set as follows:
HKCR\Helper.Helper.1\CLSID
(default)
{850C7964-9320-4055-BE11-7D7B562A6417}
HKCR\Helper.Helper\CLSID
(default)
{850C7964-9320-4055-BE11-7D7B562A6417}
Registry entries are created under:
HKCR\Helper.Helper
HKLM\SOFTWARE\Helper
|
