Written in Delphi, source included

Released in April 2003

more versions

Servers:
C:\WINDOWS\SYSTEM\ipmon.exe 
C:\WINDOWS\winsock.exe
 
size: 28.160 bytes

port: 9870 TCP

startup:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run "ipmon.exe" 
c:\windows\system.ini, [boot] "shell" 

dropped files:
c:\WINDOWS\winsock.exe 
c:\WINDOWS\SYSTEM\ipmon.exe