For example, Opera has a "wand" feature that remembers user names and password you typed across various sites.
Let's say you get a trojan, which steals data from your PC. Can the trojan decrypt stored passwords by browsers, and use them?
The points noted in Bob's answer are all valid, so I won't bother repeating them; however, I thought a little additional information might also be helpful for some, as your question is a valid concern.
To sum up:
In a word: yes. Browsers typically do not encrypt remembered passwords, so they can be read with trivial effort. Encryption with a stored key is useless anyway: if the browser is able to decrypt it, other programs running on the same computer can do the same.
I'm most familiar with Firefox, so I'll go with that.
Firefox allows you to set a 'master password'. If you do, it encrypts the stored passwords with the master password. However, for the sake of convenience, you only have to log in using this master password once per session. Once you are logged in, the information necessary to decrypt saved passwords is stored in memory, and can be accessed. A more secure and cumbersome approach would have been to require the master password to be typed every time Firefox needed to look up a saved password.
Even if the saved passwords were perfectly encrypted and completely inaccessible, they must be decrypted and entered on web forms at some point. Which means holding the passwords, unencrypted, in memory. There are actually quite a few 'asterisk revealer' programs designed to grab those passwords out of memory and, well, reveal them. Malware could theoretically do the same.
And malware could also keylog you, allowing the attacker to retrieve any password you typed.
NirSoft provides a tool called "IEPassView" which can decrypt Internet Explorer 8 and under passwords. System Information for Windows can do the same; just click on the key at the top.
NirSoft provides "password recovery" tools for many popular browsers (http://www.nirsoft.net/password_recovery_tools.html) -- these make a good "proof of concept" to show that the built-in password storage isn't safe.