Hi, The BHO you are talking about is part of a banking malware toolkit which is being sold probably. Among other things (password stealer), this BHO has backdoor and "botnet" capabilities, implementing several remote commands: + upload + run + update ... This toolkit also comprises various "infection management system" php scripts : + statistics about infections, countries... + users/victims tracking + logs parsing ... The BHO communicates directly with those scripts for sending and/or receiving captured information and remote commands respectively. Watch out for unexpected http traffic containing commandack.php,mailwab.php.. Cheers, -Rubén.
