high
Summary
Summary
Action- More Information
| Affected operating systems | Windows |
|---|---|
| Characteristics |
|
| Included in our products from | March 2005 (3.91) |
| Protection available since | 15 January 2005 17:45:09 (GMT) |
| Detected by | All Sophos products |
Action
- Summary
- Action
- More Information
Please follow the instructions for removing Trojans.
Change any data that may have become compromised.
Windows NT/2000/XP/2003
In Windows NT/2000/XP/2003 you will also need to edit the following registry entry for each user who ran the virus. The removal of this entry is optional in Windows 95/98/Me. Please read the warning about editing the registry.
At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.
Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export Range' panel, click 'All', then save your registry as Backup.
Each user has a registry area named HKEY_USERS\[code number indicating user]\. For each user locate the entry:
HKU\[code number]\Software\Microsoft\Windows\CurrentVersion\Run\
cartao
and delete it if it exists.
Close the registry editor.
More Information
Troj/Banker-AY is an information stealing Trojan that attempts to steal banking information related to certain Brazilian banks including "Bradesco" and "Gerenciador Financeiro".
Troj/Banker-AY attempts to download keylogging components from remote websites. The Trojan will then monitor the activity of Internet Explorer and attempt to keylog on websites related to the above banks. Information stolen may be sent to an attacker by email.
Troj/Banker-AY will drop the following files in the Windows system folder:
keylogf.dll
cartao.exe
cartao2.exe
Troj/Banker-AY will set the following registry entry in an attempt to run the Trojan when a user logs on to Windows:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\cartao
|
