Written in Delphi

dropped files:
:\WINDOWS\COMMAND\BACKDOOR.FTP.NUGRY.EXE  size: 433.401 bytes 
c:\WINDOWS\COMMAND\keylog.nfo             size: 244 bytes 
c:\WINDOWS\COMMAND\systemkeylog.nfo       size: 268 bytes

port: 3667 TCP

startup:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run "MicrosoftShare"
data: C:\WINDOWS\Command\BACKDOOR.FTP.NUGRY.EXE 



tested on Windows 98
January 09, 2005