Troj/Hosts-F installs a new HOSTS file in order to redirect the user from legitimate internet banking sites to malicious domains.

More information can be found at this Sophos page.