TrojanSpy.Banker.b

病毒长度：

病毒类型：木马

危害等级：*

影响平台：Win9X/2000/XP/NT/Me/2003

TrojanSpy.Banker.b是一个盗取银行帐号、密码和计算机信息的木马程序，并利用自带的SMTP引擎发送这些信息到特定的邮箱。

传播过程及特征：

1.复制自身到安装目录下。

2.修改注册表：

添加键值："OLE"="%Windir%\\<木马文件名>"

到注册表：HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run

3.创建文件:

%Windir%HookerDll.dll --- 记录键击的木马组件

%Windir%\\Krk.txt --- 用于存储信息

然后开始运行安装程序

4.删除IE缓冲区里的所有文件

5.运行一个记录键击并存储记录到Krk.txt文件的线程，如果你打开的窗口标题栏里有下列字符串信息，则此线程开始运行。

Acceso a Banca por Internet

Accueil Bred.fr > Espace Bred.fr

American Express UK - Personal Finance

ANZ E*TRADE

ANZ Internet Banking

Banco Popular - Internet Banking

Banesnet Particulares

BankSA Internet Banking Logon Page

Banque en ligne

Banque Populaire

Barclaycard Merchant Services

Business Banking Online Login Page

Citibank Australia

Collegamento a Scrigno

Commercial Electronic Office Sign On

Commonwealth Securities Limited

Credit Lyonnais interactif

Customer Support

CyberMUT

directshares

Discover Card: Account Center Log In

E*TRADE Log On

e-Bullion: Account Login

e-gold Account Access

Fleet HomeLink Online Banking and Investing

FX Online Sphinx Login Page

Home Page Banca Intesa

HSBC Internet banking

Managed Funds and Superannuation Online - Login

MasterCard Connections Online - Welcome

Merchant Administration

moneybookers.com - and money moves

Nationwide Building Society - On-line banking

NetBank - Logon

Online Services - Account Login

online@hsbc

OrbitPay.net - The Payment Processor Of Choice!

PNC Bank - Account Link for Business

SAAM Login

St George Treasury: Client Logon

St.George Internet Banking Logon Page

SunTrust Online Banking

Tous les produits et services

Ventura County Business Bank Online Banking

Wachovia Online Business Banking

Washington Mutual - Log On

Welcome to National Internet Banking

Wells Fargo - Small Business Home Page

Westpac Internet - Sign In

Westpac Internet Banking

WMcards.com