by Firelarm and Chucky
Written in Visual Basic
Released in January 2000
Server: dropped file: C:\WINDOWS\SYSTEM\EXPIORER.EXE size: 108 KB port: 58886 TCP startup: HKCU\Software\Microsoft\Windows\CurrentVersion\Run "Gytjeingm" HKCU\Software\Mirabilis\ICQ\Agent\Apps\Ajb "Path" HKLM\Software\Microsoft\Windows\CurrentVersion\Run "Bjrf" HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices "Avp"