Trend Micro Threat Encyclopedia | Latest information on malware, spam, malicious URLs, vulnerabilities

Threat Encyclopedia

Save & Share
Choose your country:

TSPY_BANCOS.DK

Overview

Download the latest scan engine

Type: Downloader

Aliases: PWSteal.Bancos.gen, TrojanSpy:Win32/VB.DS

In the wild: No

Destructive: No

Systems affected: Windows 95, 98, ME, NT, 2000, XP

Encrypted: No

Reported detections:

Low

Description:

This memory-resident spyware waits for a host to access the online banking Web site of Banco ITAU. It then displays a spoofed bank window similar to the legitimate site, thus prompting target users to disclose sensitive banking information such as user names and passwords.

It may also log keystrokes. It then saves the gathered information in a file, which it sends to a malicious user via email.

Technical Details

Initial samples received on: Oct 22, 2004

File type: PE

Memory resident: Yes

Compression type: Neolite, UPX

File size: 210,284 Bytes

Details:

Installation and Autostart

Upon execution, this spyware drops the following files in the Windows folder:

IEmon.exe
RICHTX32.OCX (normal file)
MSWINSCK.OCX (normal file)

It then executes the dropped file IEMon.exe. This executed file then drops a copy of itself in the Windows system folder as the file REGCXMARQ.EXE.

It creates the following registry entries to ensure its automatic execution at every Windows startup:

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Run
Regcxmarq = %System%\ REGCXMARQ.EXE

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\RunServices
Regcxmarq = %System%\ REGCXMARQ.EXE

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 95, 98, and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP.)

Information Theft

It may also log keystrokes. It then saves the gathered information in a file, which it sends to a malicious user via email.

Other Details

This spyware is compressed using UPX or Neolite. It is written in Visual Basic 6.

It runs on Windows 95, 98, ME, NT, 2000, and XP.

Analysis by: Elizabeth R. Viray

Solution

Minimum scan engine version needed: 6.810

Download the latest scan engine

Virus pattern version needed : 7.791.00

Pattern release date: Jan 24, 2011

Important note: The "Minimum scan engine" refers to the earliest Trend Micro scan engine version guaranteed to detect this threat. However, Trend Micro strongly recommends that you update to the latest version in order to get comprehensive protection. Download the latest scan engine here.

Solution:

Identifying the Spyware Program

To remove this spyware, first identify the spyware program.

Scan your system with your Trend Micro antivirus product.
NOTE all files detected as TSPY_BANCOS.DK.

Trend Micro customers need to download the latest pattern file before scanning their system. Other users can use Housecall, Trend Micros online virus scanner.

Terminating the Spyware Program

This procedure terminates the running spyware process. You will need the name(s) of the file(s) detected earlier.

Open Windows Task Manager.
On Windows 95, 98, and ME, press
CTRL+ALT+DELETE
On Windows NT, 2000, and XP, press
CTRL+SHIFT+ESC, then click the Processes tab.
In the list of running programs*, locate the spyware file(s) detected earlier.
Select one of the detected files, then press either the End Task or the End Process button, depending on the version of Windows on your system.
Do the same for all detected spyware files in the list of running processes.
To check if the spyware process has been terminated, close Task Manager, and then open it again.
Close Task Manager.

*NOTE: On systems running Windows 95, 98, and ME, Windows Task Manager may not show certain processes. You can use a third party process viewer such as Process Explorer to terminate the spyware process. Otherwise, continue with the next procedure, noting additional instructions.

Removing Autostart Entries from the Registry

Removing autostart entries from the registry prevents the spyware from executing at startup.

Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>Software>Microsoft>
Windows>CurrentVersion>Run
In the right panel, locate and delete the entry:
Regcxmarq = "%System%\REGCXMARQ.EXE"

In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>Software>Microsoft>
Windows>CurrentVersion>RunServices
In the right panel, locate and delete the entry:
Regcxmarq = "%System%\REGCXMARQ.EXE"
Close Registry Editor.

NOTE: If you were not able to terminate the spyware process as described in the previous procedure, restart your system.

Additional Windows ME/XP Cleaning Instructions

Users running Windows ME and XP must disable System Restore to allow full scanning of infected systems.

Users running other Windows versions can proceed with the succeeding procedure set(s).

Running Trend Micro Antivirus

Scan your system with Trend Micro antivirus and delete all files detected as TSPY_BANCOS.DK . To do this, Trend Micro customers must download the latest pattern file and scan their system. Other Internet users can use HouseCall, Trend Micros online virus scanner.