Sophos

Troj/Bancban-NU

Aliases
  • Trojan-Spy.Win32.Banbra.df
  • PWS-Banker.gen.h
  • trojan
Category
Type
What to do
Prevalence low high

Summary

 
Affected operating systems Windows
Characteristics
  • Installs itself in the registry
Included in our products from March 2006 (4.03)
Protection available since 13 January 2006 22:26:36 (GMT)
Last updated 25 January 2006 06:31:48 (GMT)
Detected by All Sophos products

Action

More Information

Troj/Bancban-NU is an Internet banking Trojan for the Windows platform.

Troj/Bancban-NU includes functionality to:

- steal information
- send notification messages to a remote location via email
- download, install and run new software.

When first run Troj/Bancban-NU copies itself to <System>\smsr.scr.

The following registry entry is created to run smsr.scr on startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
dark
<System>\smsr.scr

RSS|Atom
Get reports about the latest virus and spyware threats delivered to your computer