Written in Delphi

 

Server
dropped files:
c:\aa.bmp                 Size: 614,466 bytes 
c:\WINDOWS\Windows.exe    Size: 155,136 bytes 

port: 80 TCP

startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "MSN Task Manager"
data: C:\WINDOWS\windows.exe spymode 


tested on Windows XP
July 05, 2007