Antivirus and Security Software from Sophos

Sophos blogs

Troj/Brogger-D

Aliases
  • Trojan-Spy.Win32.Banker.agn
  • PWS-Banker.gen.i
  • trojan
  • TSPY_BANKER.AKA
Category
Type
What to do
Prevalence low high

Summary

 
Affected operating systems Windows
Characteristics
  • Installs itself in the registry
Protection available since 30 November 2005 10:12:06 (GMT)
Detected by All Sophos products
  • Free virus, spyware, and adware scan
  • Test your existing anti-virus protection
  • Find threats your anti-virus missed

Action

More Information

Troj/Brogger-D is a Trojan for the Windows platform.

Troj/Brogger-D targets the customers of certain online banking websites. The Trojan monitors browser usage and logs any account details entered, and may display fake user interfaces and record any entered details.

When Troj/Brogger-D is installed the following files are created:

<System>\dllcboxz.dll
<System>\msndrvsys.dll
<System>\msndrvsys.exe
<System>\xrosario.sdf

dllcboxz.dll is a clean DLL, and can safely be removed. xrosario.sdf is a clean data file, and can also safely be deleted.

msndrvsys.exe and msndrvsys.dll are detected as Troj/Brogger-D.

The following registry entry is created to run msndrvsys.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
msndrvsys
<System>\msndrvsys.exe

RSS|Atom
Get reports about the latest virus and spyware threats delivered to your computer