Home / malware

PDF

Bancos.VE

First posted on 13 September 2006.
Source: SecurityHome

Aliases :

There are no other names known for Bancos.VE.

Explanation :

Bancos.VE is a password stealing trojan specifically designed for stealing Bank Information from users of Brazilian Banks.

Upon execution, Bancos.VE displays the following fake error message:

Requerdo Windows NT Server


It will then drop a copy of itself into the System Directory as Tasklist32.exe:

%systemdir% asklist32.exe

Note: %systemdir% by default is C:WindowsSystem32.

It also creates the following registry value for its auto-start mechanism:

HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun

TaskList = "%systemdir% asklist32.exe"


This malware monitors users' visited URLs. When specific URLs are viewed by a user, it will log all keyboard strokes.

Below are the URLs monitored by this trojan:

bankline.itau.com.br
https://www2.bancobrasil.com.br/aapf/saldos/006.jsp?codT=0
https://www2.bancosbrasil.com.br/aapff/aaii/principal
www2.bancobrasil.com.br


Bancos.VE sends the gathered information to a Brazilian e-mail address.

Solution :

To manually disinfect standalone malware (backdoors, worms, trojans, etc.) it's usually enough to delete all infected files from a computer and to restart it. Active malware files are usually locked by operating system so different disinfection approaches are required for different operating systems.
Please note that manual disinfection is a risky process, so it is recommended only for advanced users.

If Windows 95, 98 and ME operating system is used, it is recommended to restart a computer from a bootable system diskette and to delete an infected file from command prompt. For example if a malicious file named ABC.EXE is located in Windows folder, it is usually enough to type the following command at command prompt:

DEL C:\WINDOWS\ABC.EXE

and to press Enter. After that an infected file will be gone. If Windows NT, 2000 or XP is used, a malicious file has to be renamed with a different extension (for example .VIR) and then a system has to be restarted. After restart a renamed malicious file will no longer be active and it can be easily deleted manually.

Windows System Restore Issues

If Windows ME or XP is used, it is recommended to disable System Restore feature of these operating systems to prevent a computer from re-infection by an already removed malware. The fact is that System Restore feature of these operating systems might save an infected file into the special folder and copy it back to a hard drive it every time it's been renamed or deleted.
It is recommended to re-enable System Restore after disinfection in order to restore stable system configuration in the future, if any crash or incompatibility issue occurs.

Last update 13 September 2006

 

TOP