...cybercriminals are currently mailing infected CDs to credit unions and smaller banks as part of a clever offline scheme to loadmalicious software into computers with valuable data. According to an alert issued by the National Credit Union Association...
http://blogs.zdnet.com/security/?p=4121
... When executed on startup as a replacement to the original winlogon.exe, Troj/WLHack-A will attempt to loadmalicious code from either one of the following files: - ws2_32.dll:fork2 - wsys.dll The file ws2_32...
http://www.sophos.com/security/analyses/trojwlhacka.html