high
Summary
Summary
Action- More Information
| Affected operating systems | Windows |
|---|---|
| Characteristics |
|
| Included in our products from | November 2005 (3.99) |
| Protection available since | 2 September 2005 13:10:56 (GMT) |
| Last updated | 11 October 2005 19:50:10 (GMT) |
| Detected by | All Sophos products |
Action
- Summary
- Action
- More Information
Please follow the instructions for removing Trojans.
Change any data that may have become compromised.
Windows NT/2000/XP/2003
In Windows NT/2000/XP/2003 you will also need to edit the following registry entry for each user who ran the virus. The removal of this entry is optional in Windows 95/98/Me. Please read the warning about editing the registry.
At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.
Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export Range' panel, click 'All', then save your registry as Backup.
Each user has a registry area named HKEY_USERS\[code number indicating user]\. For each user locate the entry:
HKU\[code number]\Software\Microsoft\Windows\CurrentVersion\Run\
lsassig
<System>\drivers\lsassig.exe
and delete it if it exists.
Close the registry editor.
More Information
Troj/Bancos-EC is an Internet Banking Trojan for the Windows platform.
Troj/Bancos-EC monitors the user's internet activity and displays fake login pages if the user visits certain predefined URLs. Any login details entered on the fake pages are logged.
The Trojan may attempt to send the stolen information to a remote address.
When first run Troj/Bancos-EC creates the following filenames:
<System>\drivers\copy38.exe
<System>\drivers\bzr.exe
<System>\drivers\lsassig.exe
<System>\drivers\rze.exe
<System>\drivers\sza.exe
<System>\drivers\uzn.exe
<System>\drivers\nze.exe
The Trojan also creates the following data files, which may be deleted:
<System>\drivers\bza.bxz
<System>\drivers\bzb.bxz
<System>\drivers\bzr.bxz
<System>\drivers\copy38.bxz
<System>\drivers\cza.bxz
<System>\drivers\izt.bxz
<System>\drivers\nze.bxz
<System>\drivers\rze.bxz
<System>\drivers\sza.bxz
<System>\drivers\uzn.bxz
<System>\windvx.sso
Troj/Bancos-EC may also store stolen information under the following folder:
<System>\drivers\temp_log - this may be deleted.
The following registry entry is created to run lsassig.exe on startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
lsassig
<System>\drivers\lsassig.exe
|
