by Alchemist & r3l4x
Written in Visual Basic
Released in March 2005
Server: dropped files: c:\WINDOWS\winlogon.exe Size: 106,934 bytes c:\WINDOWS\system32\Kernel.bat Size: 7,552 bytes port: 890 TCP added to registry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "Windows Logon Application" data: C:\WINDOWS\winlogon.exe tested on Windows XP April 05, 2006MegaSecurity