Released in May 2007

Made in Turkey

Server:
Dropped File:
c:\WINDOWS\system32\exphome.exe
Size: 40,960 bytes 

Startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon "Userinit"
Old data: C:\WINDOWS\system32\userinit.exe, 
New data: \WINDOWS\system32\userinit.exe,\Windows\System32\exphome.exe 



Tested on Windows XP
January 30, 2008