Home Malware Programs Trojans PWS-Banker!gym

PWS-Banker!gym

Posted: August 18, 2011

PWS-Banker!gym is a harmful Trojan infection that infiltrates into the corrupted PC without a user's consent. PWS-Banker!gym can access the targeted machine quite easily, but it is complicated to remove. PWS-Banker!gym can be used to show pop-up ads, redirect you to malicious websites, control your web browser, record your keystrokes and execute other malicious actions. PWS-Banker!gym is a serious computer threat that should be deleted as soon as possible once detected on a compromised PC.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



%WINDIR%\SYSTEM32\liamtoh.exe File name: %WINDIR%\SYSTEM32\liamtoh.exe
File type: Executable File
Mime Type: unknown/exe
%WINDIR%\SYSTEM32\windowflesh.dll File name: %WINDIR%\SYSTEM32\windowflesh.dll
File type: Dynamic link library
Mime Type: unknown/dll

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\..\..{Subkeys}HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\CLSID\{462D8011-7EEA-46F1-94E7-E81C6A1243A4}\INPROCSERVER32\HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\CLSID\{462D8011-7EEA-46F1-94E7-E81C6A1243A4}\HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{B1D3576A-CA42-4D09-83C1-15D563C19D71}\HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{462D8011-7EEA-46F1-94E7-E81C6A1243A4}\
Loading...