Released in June 2004

Made in France

 

Server:
dropped file:
c:\WINDOWS\system32\spoolvs.exe
size: 196,608 bytes 

port: 8765 TCP

startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "$spoolvs"
data: C:\WINDOWS\SYSTEM32\spoolvs.exe 




tested on Windows XP
September 01, 2007