Troj/IBank-A

Please follow the instructions for removing Trojans.

Troj/IBank-A is an internet banking Trojan.

The Trojan runs continuously in the background, waiting for the user to access the login page for the National Australia Bank and then tries to capture Window text and send it to a remote location via HTTP.

When first run Troj/IBank-A copies itself to the Windows folder as audld.exe and to the Windows system folder as wmbem.exe.

The following registry entries are created to run wmbem.exe and audld.exe on startup:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
WinUpdate = %SYSTEM%\wmbem.exe

HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\
run = %WINDOWS%\audld.exe

The pathname of audld.exe is also added to a new run= line in the [Windows] section of %WINDOWS%\Win.ini, to run audld.exe on startup.

The registry entry HKLM\SOFTWARE\Wmbem\ may be created.