Written in Visual Basic, compressed with UPX

image shown by server

Moon Trojan:

dropped files:
c:\Documents and Settings\%user%\Desktop\foto8.jpg  size: 1.260 bytes 
c:\WINNT\system32\SVCH0ST.EXE                       size: 39.424 bytes

startup:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Microsoft"

tested on win2000