Sophos

Sophos blogs

Troj/Bankgerm-C

Aliases
  • Backdoor.Win32.Bancodor.x
Category
Type
What to do
Prevalence low high

Summary

 
Affected operating systems Windows
Characteristics
  • Drops more malware
  • Installs itself in the registry
Protection available since 7 February 2005 23:01:21 (GMT)
Detected by All Sophos products
Download Free virus scan
Download the Threat Detection Test
  • Free virus, spyware, and adware scan
  • Test your existing anti-virus protection
  • Find threats your anti-virus missed

Action

Please follow the instructions for removing Trojans.

Change any data that may have become compromised.

More Information

Troj/Bankgerm-C is a password-stealing Trojan.

Troj/Bankgerm-C drops the file iempview.dll, detected as Troj/Bancsde-A, to the Windows folder to assist in its Trojan functionality.

Troj/Bankgerm-C steals information related to certain banking-related websites as they are accessed, sending this information periodically using Microsoft Internet Explorer to a predefined.

Troj/Bankgerm-C may display fake websites to get the user to enter private information. The urls being tracked are:

'banking-classic.postbank.de'
'banking.postbank.de'
'cc-bank.de'
'citibank.de'
'deutsche-bank.de'

Troj/Bankgerm-C may create or modify the following registry entries:

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Setting\
WarnOnPostRedirect
0

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Setting\
WarnOnZoneCrossing
0

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\
1609
0

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\
1609
0

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\
1609
0

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\
1609
0

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\
1609
0

RSS|Atom
Get reports about the latest virus and spyware threats delivered to your computer