Reports about Trojan.Bankpatch.C, a sophisticated online banking Trojan, have been hitting the news wires in Denmark. The first version of this threat was released in 2007 and the latest .C variant in August of 2008. However, the life of the threat continues today as the authors continue to distribute the threat and update plug-in modules that target specific banks. Most recently they’ve seen some success in Denmark deploying modules specifically focused on obtaining online banking credentials for numerous Danish banks. While Symantec is continuing deeper analysis of the threat’s latest actions and modules, we wanted to provide a high-level overview of the threat.Usually Bankpatch will arrive via a popular means of infection such as Web pages hosting exploits against Internet Explorer and third-party browser plug-in vulnerabilities. Once executed on the machine, Bankpatch will add code to multiple Windows system files and patch key routines so that when these routines are executed, execution is redirected to the injected code.Bankpatch not only injects its code into these system files to hide itself but also uses them as a trigger mechanism to perform additional actions. For example, Bankpatch adds code and patches wininet.dll, which provides client network functionality. This allows Bankpatch to track when Internet Explorer is being used.When a user begins a browsing session, Bankpatch will contact one of its command-and-control servers. Bankpatch first sends system information and then receives instructions. Currently, many of these command-and-control servers appear to be down.Typically, additional DLLs are downloaded including BHOs (Browser Helper Objects), which are loaded into Internet Explorer. These BHOs are customized to target certain online banking systems and proceed to steal users’ online banking information. These BHOs will be detected as Infostealer.Nadebanker.Watch out for additional blogs about some of the more interesting features of Bankpatch and Nadebanker. If you think you may be infected, you can scan your system using Symantec Security Check. In addition, Symantec provides a removal tool and step-by-step instructions to assist you in ridding your computer of these threats—they are available here.