high
Summary
Summary
Action- More Information
| Affected operating systems | Windows |
|---|---|
| Characteristics |
|
| Included in our products from | December 2004 (3.88) |
| Protection available since | 8 November 2004 13:50:07 (GMT) |
| Detected by | All Sophos products |
Action
- Summary
- Action
- More Information
Please follow the instructions for removing Trojans.
Change any data that may have become compromised.
Windows NT/2000/XP/2003
In Windows NT/2000/XP/2003 you will also need to edit the following registry entry. The removal of this entry is optional in Windows 95/98/Me. Please read the warning about editing the registry.
At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.
Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.
Locate the HKEY_LOCAL_MACHINE entry:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
KernellApps<Windows system>\System\csrss.exe
and delete it if it exists.
Close the registry editor.
More Information
Troj/Bancban-AC is a password-stealing Trojan targeted at customers of certain Brazilian banks.
Troj/Bancban-AC attempts to log keypresses entered into certain websites. The Trojan displays fake user interfaces in order to persuade the user to enter confidential details. Stolen information is sent by email to a remote user.
Troj/Bancban-AC also attempts to detect and delete files belonging to Norton AntiVirus and Norton Personal Firewall.
Stolen data may be saved to a file USER.TXT. An image file BARRA.BMP may also be dropped. Troj/Bancban-AC is a password-stealing Trojan targeted at customers of certain Brazilian banks.
Troj/Bancban-AC attempts to log keypresses entered into certain websites. The Trojan displays fake user interfaces in order to persuade the user to enter confidential details. Stolen information is sent by email to a remote user.
Troj/Bancban-AC copies itself as CSRSS.EXE to a subfolder SYSTEM of the Windows system folder and creates the following registry entry in order to run itself on system startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
KernellApps<Windows system>\System\csrss.exe
Troj/Bancban-AC also attempts to detect and delete files belonging to Norton AntiVirus and Norton Personal Firewall.
Stolen data may be saved to a file USER.TXT. An image file BARRA.BMP may also be dropped.
|
