“Backdoor.Lavandos.A steals personal data from accounts on the infected computer after setting up a ‘setupapi.dll’ in the installation root folder for Mozilla Firefox, Opera and Internet Explorer,” according to SC Magazine.
esecurityplanet.com