high
Summary
Summary
Action- More Information
| Affected operating systems | Windows |
|---|---|
| Characteristics |
|
| Included in our products from | November 2005 (3.99) |
| Protection available since | 29 September 2005 22:36:11 (GMT) |
| Detected by | All Sophos products |
Action
- Summary
- Action
- More Information
Please follow the instructions for removing Trojans.
More Information
Troj/Bankgerm-D is a password-stealing Trojan for the Windows platform.
When Troj/Bankgerm-D is installed it creates a file in the Windows folder with a randomly generated name. This file is also detected as Troj/Bankgerm-D.
The following registry entry is created to run hijsrv.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HijSrv32
<Windows>\hijsrv.exe
The following registry entries are set, affecting internet security:
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
1609
0
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
1609
0
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
1609
0
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
1609
0
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4
1609
0
Registry entries are set as follows:
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings
WarnOnPostRedirect
0
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings
WarnOnZoneCrossing
0
|
