Trojan:Win32/VB.BE

Installation

• Adds value: "Userinit"
  With data: v,<system folder>\userinit.exe"
  To subkey: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon  
• Adds value: "Userinit"
  With data: "<system folder>\<random 8 letters>.exe,<system folder>\userinit.exe"
  To subkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon 

Payload

• %program_files%\3721\helper.dll
• %program_files%\3721\assist\asbar.dll
• %windir%\pbar.dll
• %program_files%\akl\unsetup.exe
• %program_files%\p2pnetworks\amp2pl.exe

• <application data>\microsoft\internet explorer\desktop.htt
• %windir%\default.htm

• Sets value: "BackupWallpaper"
  With data: "%systemroot%\web\wallpaper\bliss.bmp"
  To subkey: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\General
• Sets value: "DeskHtmlVersion" 
  With data: "272"
  To subkey: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components
• Sets value: "Source"
  With data: "about:home"
  To subkey: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0