From; Sophos Alert System: Name: Troj/Bancb-Fam Type: Trojan Date: 3 June 2005 Sophos has issued protection for Troj/Bancb-Fam. At the time of writing, Sophos has received a small number of reports of this Trojan from the wild. Customers using EM Library, Enterprise Console, PureMessage or any of our Sophos small business solutions will be automatically protected at their next scheduled update. Information about Troj/Bancb-Fam can be found at: http://www.sophos.com/virusinfo/analyses/trojbancbfam.html Troj/Bancb-Fam detects members of the Bancban family of Trojans. Members of this family typically attempt to steal confidential information when a user visits banking-related websites. Trojans of this family typically monitor URLs entered into Internet Explorer. When certain websites are visited, the Trojan may display a fake user interface in order to trick the user into entering confidential details. Stolen information is sent by email to a remote user. Typically a registry entry is created in order to run the Trojan on system startup: HKLM\Software\Microsoft\Windows\CurrentVersion\Run <Trojan filename excluding extension> <Path to Trojan> The Troj/Bancb-Fam virus identity file (IDE) includes detection for: Troj/Banca-Fam http://www.sophos.com/virusinfo/analyses/trojbancafam.html Troj/Bancos-Fam http://www.sophos.com/virusinfo/analyses/trojbancosfam.html Troj/Bancor-Fam http://www.sophos.com/virusinfo/analyses/trojbancorfam.html Customers with 3.xx or lower versions of Sophos Anti-Virus, who are not running EM Library, can manually download the IDE for Troj/Bancb-Fam from: http://www.sophos.com/downloads/ide/bancbfam.ide Read about how to use IDE files at http://www.sophos.com/support/knowledgebase/article/363.html *********** MIKE"S REPLY SEPARATOR *********** Mike ~ It is a good day if I learned something new. Editor MikesWhatsNews see a sample on my web page http://www3.telus.net/mikebike <mikeswhatsnews-request@xxxxxxxxxxxxx?Subject=subscribe> http://www3.telus.net/mikebike/worm_removal.htm See my Anti-Virus pages http://virusinfo.hackfix.org/index <virusinfo-request@xxxxxxxxxxxxx?Subject=subscribe> A Technical Support Alliance and OWTA Charter Member