Written in Visual Basic

Original Filename: Serv.exe

Server:
dropped file:
c:\WINDOWS\system32\SYRIUS.EXE
size: 76.800 bytes 

startup:
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run "Eqnmpyg"
data: C:\WINDOWS\SYSTEM32\SYRIUS.EXE 

HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run "Eqnmpyg"
data: C:\WINDOWS\SYSTEM32\SYRIUS.EXE 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "Gcozqczuk"
data: C:\WINDOWS\SYSTEM32\SYRIUS.EXE 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices "Adb"
data: C:\WINDOWS\SYSTEM32\SYRIUS.EXE 


tested on Windows XP
December 25, 2004