Based on Source of Messiah by Splinter

Written in Visual Basic

Released in September 2006

Server:
dropped files:
c:\WINDOWS\system\Update.exe
size: 409,755 bytes 

port: 876, 1216, 958 TCP

startup:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Windows Updates"
data: c:\windows\system\Update.exe 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "Windows Updates"
data: c:\windows\system\Update.exe 



tested on Windows XP
October 10, 2006