Server:
C:\WINDOWS\INTERNAL.EXE

size: 358 KB

startup:
HKLM\software\microsoft\windows\currentversion\run

deletes:
C:\WINDOWS\VGA.DAT