Troj/PWS-ATU steals internet account details and sends them to a preconfigured email address.
When first run, Troj/PWS-ATU copies itself to ctfmgr.exe in the Windows folder and creates the following registry entry in order to be run automatically:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
ctfmgr
<Windows>\ctfmgr.exe