by Carl-Fredrik Neikter
Written in Delphi
Released in September 2000
Server: dropped files: c:\WINDOWS\keykook.dll size: 55.296 bytes c:\WINDOWS\Patch.exe size: 201.728 bytes port: 12345, 12346 TCP startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "Patch" data: C:\WINDOWS\Patch.exe /nomsg tested on Widows XPMegaSecurity