Troj/Banker-VF

Category: Viruses and SpywareProtection available since:10 Jan 2006 00:00:00 (GMT)
Type: TrojanLast Updated:10 Jan 2006 00:00:00 (GMT)
Prevalence: Small Number of Reports

Download Download our free Virus Removal Tool - Find and remove threats your antivirus missed

Troj/Banker-VF is a Trojan for the Windows platform.

Troj/Banker-VF includes functionality to send notification messages to remote locations.

The Trojan monitors Internet Explorer sessions and attempts to steal credentials entered into login forms on certain financial websites. Collected information is sent to a remote attacker via email or FTP.

When first run Troj/Banker-VF copies itself to <Windows>\Config\svchost.exe.

The following registry entry is changed to run microsoft.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Microsoft Office
<Windows>\Config\microsoft.exe