Troj/Bankhof-E

Aliases	Trojan-Dropper.Win32.Agent.aar PWS-Banker.dll PWSteal.Banker.B
Category	Viruses and Spyware
Type	Trojan
What to do	If you've received an alert for a virus or spyware, then follow the instructions for removing the threat.
Prevalence	low high

Summary


Affected operating systems	Windows
Characteristics	Installs itself in the registry
Protection available since	8 December 2005 14:30:45 (GMT)
Detected by	All Sophos products

Free virus scan
Download the Threat Detection Test

Troj/Bankhof-E is a password stealing Trojan for the Windows platform.

When Troj/Bankhof-E is installed the following files are created:

<System&lgt;\rdrlib.dll
<System>\msctr.dll

msctr.dll is detected as Troj/Bankhof-D.

The following registry entry is created to run code exported by OLE Module on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ SharedTaskScheduler
(0C81EA61-20F8-4DDC-81BF-AF0923078398)
Automation Object

The following registry entry is set:

HKCU\Software\Classes\CLSID\(0C81EA61-20F8-4DDC-81BF-AF0923078398)\ InProcServer32
(default)
<System>\msctr.dll

Registry entries are created under:

HKCU\Software\Classes\CLSID\(0C81EA61-20F8-4DDC-81BF-AF0923078398)\ InProcServer32\

Get reports about the latest virus and spyware threats delivered to your computer