Written in Visual Basic

Released in December 2001

Made in China

Server:
dropped files:
c:\WINDOWS\SYSTEM\Rundll16.exe 
c:\WINDOWS\SYSTEM\WININI.EXE 
C:\WINDOWS\SYSTEM\MSDLL.EXE

size: 163.840 bytes 

port: 1002, 1902, 2001, 5902 TCP

startup:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run "RUNDLL32" 
HKEY_CLASSES_ROOT\chm.file\shell\open\command "(Default)" 
HKEY_CLASSES_ROOT\exefile\shell\open\command "(Default)" 
HKEY_CLASSES_ROOT\scrfile\shell\open\command "(Default)" 
HKEY_CLASSES_ROOT\txtfile\shell\open\command "(Default)"