Written in Visual Basic

Released in October 1999

Server:
dropped file:
C:\WINDOWS\SYSTEM\WINPROT.EXE

size: 49.152 bytes

port: 13473 TCP

startup:
c:\windows\win.ini
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
HKU\.default\Software\Microsoft\Windows\CurrentVersion\Run