Troj/Bankhof-B

Aliases	MultiDropper-OC
Category	Viruses and Spyware
Type	Trojan
What to do	If you've received an alert for a virus or spyware, then follow the instructions for removing the threat.
Prevalence	low high

Summary


Affected operating systems	Windows
Characteristics	Installs itself in the registry
Included in our products from	November 2005 (3.99)
Protection available since	12 September 2005 07:56:43 (GMT)
Detected by	All Sophos products

Troj/Bankhof-B is a banker Trojan targeted at users of online German banks.

When Troj/Bankhof-B is run, the following files are created:

<System>\msbnk.dll
<System>\rdrlib.dll

The following registry entries are set to run Troj/Bankhof-B on startup:

HKCU\Software\Classes\CLSID\{190EE07F-D388-410c-A42D-11BD588E10FE}
InProcServer32
(default)
<System>\msbnk.dll

HKCU\Software\Classes\CLSID\{190EE07F-D388-410c-A42D-11BD588E10FE}\InProcServer32\ThreadingModel
Apartment

HKCR\CLSID\{190EE07F-D388-410c-A42D-11BD588E10FE}\InProcServer32
(default)
<System>\msbnk.dll

HKCR\CLSID\{190EE07F-D388-410c-A42D-11BD588E10FE}\InProcServer32\ThreadingModel
Apartment

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\(190EE07F-D388-410c-A42D-11BD588E10FE)
OLE Module

Registry entries are created under the following key affecting internet security:

HKCU\Software\Microsoft\Internet Explorer\Security

Get reports about the latest virus and spyware threats delivered to your computer