PWS:Win32/VB.DT

PWS:Win32/VB.DT is a multi-component Trojan that attempts to steal sensitive data. It logs key strokes and retrieves information stored on the infected machine. It may also overwrite certain applications with its key logger components, and download and execute arbitrary files.

This trojan may disguise itself as any one of the following applications:
Crack Program
Explorer
Installer
Key Generator
MSPAint
Media Player
Microsoft Photo Editor
Office document
Screensaver
Serial Generator
WinRar
WordPad

This trojan goes to some lengths to disguise its presence. It may display or execute certain types of files depending on the application it mimics. For example, a variant disguised as a crack application may display the following Message Box:

 

Another variant disguised as an installer, may display this message box:

 
It drops the following files:

Note: The trojan will overwrite files with these names should they already exist on an affected system.

It modifies the registry to ensure that Office10.exe (TrojanSpy:Win32/Keylogger.EN) is executed at each Windows start:
Adds value: "MS Office"
With data: "%PROGRAM_FILES%\Common Files\System\Office10.exe"
To subkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

The dropped component, %PROGRAM_FILES%\Common Files\System\Office10.exe, is used for downloading and executing other malware components from a remote site.
Steals Sensitive Data
The dropped component, %PROGRAM_FILES%\MSN Messenger\msnmsgr.exe, is used for keylogging. It logs keystrokes and retrieves system and program information such as IP addresses, passwords and serial numbers. After this information has been recorded, the log file is sent to the remote attacker via e-mail.
Deletes File
PWS:Win32/VB.DT deletes the following file if found: