Released in August 2007

more versions

Server
Dropped Files:
c:\WINDOWS\system32\fsdutil.exe    Size: 61,440 bytes 
c:\WINDOWS\system32\ntvdc.exe      Size: 61,440 bytes 
c:\WINDOWS\system32\wingtsv.exe    Size: 61,440 bytes 
c:\WINDOWS\system32\wnsydrv.exe    Size: 61,440 bytes 	

Startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce "Java Virtual Machine"
Data: wingtsv.exe 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon "System Startup"
Data: wingtsv.exe 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon "Windows startup"
Data: explorer.exe wingtsv.exe 
	
	
	
Tested on Windows XP
February 14, 2008