How to remove TSPY_BANKER.MTX

[DeMario]

Hi every, I want remove TSPY_BANKER.MTX virus from my system. This virus sucking up my system resources which displayed on the task manager. This virus came in to my computer 1 week before when I was browsing an Internet for downloading some kind of application. My anti virus application are not able to delete this virus. Can one tell me how to remove.

[Milton.J]

TSPY_BANKER.MTX grayware keeps eye on the Internet Explorer activities of the infected computer, especially on the address bar of the browser. This grayware regenerates a rules Web site with a hoax sign in page if a user visits banking web sites with specific strings in the address bar. The hoaxed login overlaps the ruled login area of the Web site, thus tricking the user into thinking that it is part of the IE window.

[Spyrus]

How does this virus install in your system.

TSPY_BANKER.MTX this makes the given malicious file.

%Windows%\reg_0001.txt - non malicious

TSPY_BANKER.MTX virus changes the given registry entry:

HKEY_CURRENT_USER\Software\Microsoft\Winodws\CurrentVersion\Run
{Malware name} = "{Malware path and file name}"

[Snake08]

TSPY_BANKER.MTX virus keeps an eye on the Internet Explorer (IE). This virus regenerates a ruled Web site with a hoaxed login page if a user goes banking sites with the given in the address bar.

• http://www.banrisul.com.br/
• http://www.bradesco.com.br/
• http://www.bradescopessoajuridica.com.br/
• https://bradesconetempresa.com.br/ne....asp?CONTROLE=
• https://bradesconetempresa.com.br/scripts/office.dll/
• DISPOSITIVO2/VERIFICADISPOSITIVO
• https://netbanking2.banespa.com.br/d...sp?txtAgencia=
• https://www.santandernet.com.br/default.asp?txtAgencia=
• https://www2.bancobrasil.com.br/aapf...p?aapf.IDH=sim
• https://wwwss.bradesco.com.br/script...dll/LOGIN?AGN=

[Zachary]

Deleting this autostart entries in the registry

Open Registry Editor.

Click Start>Run and then type REGEDIT, now press Enter.

HKEY_CURRENT_USER\Software\Microsoft\Winodws\CurrentVersion\Run