Troj/VB-VT

Category: Viruses and Spyware
Type: Trojan
Prevalence: No Reports

Download Download our free Virus Removal Tool - Find and remove threats your antivirus missed

Troj/VB-VT is a Trojan for the Windows platform.

The Trojan attempts to monitor other windows and disable the registry editor.

When first run Troj/VB-VT copies itself to:

<Windows>\abcdefg23.exe
<Windows>\hiklmnop27.exe

The following registry entries are created to run abcdefg23.exe and hiklmnop27.exe on startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
BT000035
<Windows>\abcdefg23.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
BT000032
<Windows>\hiklmnop27.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
BT000036
<Windows>\abcdefg23.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
BT000033
<Windows>\hiklmnop27.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
BT000037
<Windows>\abcdefg23.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce
BT000034
<Windows>\hiklmnop27.exe

HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\(Z352B9SN-YRBV-I0TC-U6KM-K2AC50E4Q904)
StubPath
<Windows>\abcdefg23.exe

The following registry entry is changed to run abcdefg23.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell
Explorer.exe <Windows>\abcdefg23.exe

(the default value for this registry entry is "Explorer.exe" which causes the Microsoft file <Windows>\Explorer.exe to be run on startup).

The following registry entry is set, disabling the registry editor (regedit):

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableRegistryTools
1