TrojanDropper:Win32/Small.OT

Registers the Web browser Internet Explorer as an authorized application, allowed to access the Internet, by adding an entry into the registry:
Adds value: %ProgramFiles%\Internet Explorer\IEXPLORE.EXE
With data: %ProgramFiles%\internet explorer\iexplore.exe:*:enabled:internet explorer
To subkeys:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List

Enables Web browser helper objects by adding an entry into the registry:
Modifies value: Enable Browser Extensions
With data: yes
To subkey: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main

Drops the file mem.dll into the Windows system folder; the default location of the Windows system folder is C:\Windows\System32 (Windows XP, Vista); C:\Winnt\System32 (Windows NT/2000), C:\Windows\System (Windows 95/98/ME)

Registers mem.dll as a service by creating a unique CLSID and adding an entry into the registry:
Adds value: {36DBC179-A19F-48F2-B16A-6A3E19B42A87}\InprocServer32\(Default)
With data: <system folder>\mem.dll
To subkey: HKEY_LOCAL_MACHINE\SOFTWARE\Classes

Creates an additional registry entry as a load "option" for the Trojan:
Adds value: load\net_insll
With data: =.
To subkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\

bankofamerica.com

Barclays.com

nationet.com

postbank.de

if.com

ebay