Troj/VB-VT

Aliases	Trojan.Win32.VB.vt
Category	Viruses and Spyware
Type	Trojan
What to do	If you've received an alert for a virus or spyware, then follow the instructions for removing the threat.
Prevalence	low high

Summary


Affected operating systems	Windows
Characteristics	Installs itself in the registry
Included in our products from	January 2006 (4.01)
Protection available since	11 November 2005 04:06:30 (GMT)
Detected by	All Sophos products

Troj/VB-VT is a Trojan for the Windows platform.

The Trojan attempts to monitor other windows and disable the registry editor.

When first run Troj/VB-VT copies itself to:

<Windows>\abcdefg23.exe
<Windows>\hiklmnop27.exe

The following registry entries are created to run abcdefg23.exe and hiklmnop27.exe on startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
BT000035
<Windows>\abcdefg23.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
BT000032
<Windows>\hiklmnop27.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
BT000036
<Windows>\abcdefg23.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
BT000033
<Windows>\hiklmnop27.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
BT000037
<Windows>\abcdefg23.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce
BT000034
<Windows>\hiklmnop27.exe

HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\(Z352B9SN-YRBV-I0TC-U6KM-K2AC50E4Q904)
StubPath
<Windows>\abcdefg23.exe

The following registry entry is changed to run abcdefg23.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell
Explorer.exe <Windows>\abcdefg23.exe

(the default value for this registry entry is "Explorer.exe" which causes the Microsoft file <Windows>\Explorer.exe to be run on startup).

The following registry entry is set, disabling the registry editor (regedit):

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableRegistryTools
1

Get reports about the latest virus and spyware threats delivered to your computer