ctfmor.exe

Trojan - W32.Bancos

Saturday, 04 February 2012 13:41

The name ctfmor.exe has appeared in a virus analysis report. You can see it on this link

It tries to change the internet settings of the affected computer by running a PAC configuration file. 

• The installer is of about 682 KB. It could be a virus Trojan Infostealer Bancos/ Banker/Banbra. 
• It has threat characteristics of ZBot - a banking trojan that disables firewall, steals sensitive financial data (credit card numbers, online banking login details), makes screen snapshots, downloads additional components, and provides a hacker with the remote access to the compromised system.
• It may stop services ALG/ Application Layer Gateway Service, SharedAccess/ Windows Firewall/Internet Connection Sharing (ICS)
• Trojan.Bancos runs silently in the background to monitor web browser activities. It can create fake login page for certain banking sites which is used for stealing usernames and passwords which can be sent to the attacker via e-mail.
• It may modify the hosts file so as to redirect or block sites. Or it deletes the hosts file.
• It may delete safeboot registry keys. This will prevent the computer from starting in safe mode. The remedy to this problem is to reinstall windows.
• According to Symantec
  
  The Trojan is most often spread by way of an email containing a social engineering trick such as a fake email from a bank asking the user to run the attached program and perform some other actions to verify their banking details. If the user complies with the request they could potentially reveal their account access information which may lead to significant financial loss.
  
  You can read the the writeup at Symantec on this link

It creates ctfmor.exe and other files on the infected computer that you need to search and delete.  You should also remove the entries of these files from the windows startup.

Read more: ctfmor.exe