Released in March 2008

Made in Turkey

Server
Dropped File:
c:\WINDOWS\system32\system32.exe
Size: 197,093 bytes 

Startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon "Userinit"
Old data: \WINDOWS\system32\userinit.exe 
New data: \WINDOWS\system32\userinit.exe,\WINDOWS\system32\system32.exe 	



Tested on Windows XP
June 24, 2008

MegaSecurity