aka PowerHack

Written in Delphi

Released in July 2004

Made in Poland

Server:
dropped file:
c:\WINDOWS\system\ph.exe
size: 380,928 bytes 

port: 997 TCP

startup:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "ph"
data: C:\WINDOWS\system\ph.exe 



tested on Windows XP
May 11, 2005