Released in April 2004

hypnotized_hallucination_rat 3.4:

port: 5110, 5112, 5110 TCP

dropped files:
c:\WINDOWS\winlogon.exe           size: 326.657 bytes 
c:\WINDOWS\SYSTEM\sservice.exe    size: 326.657 bytes 
c:\WINDOWS\SYSTEM\wincom.exe      size: 326.657 bytes 
c:\WINDOWS\SYSTEM\wincom_.exe     size: 1.044.168 bytes 
c:\WINDOWS\SYSTEM\winkey.dll      size: 24.576 bytes 
c:\WINDOWS\SYSTEM32\fservice.exe  size: 326.657 bytes

startup:
HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y} "StubPath"
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run "DirectX For Microsoft� Windows" 
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon "Shell"
c:\windows\system.ini, [boot] "shell" 
c:\windows\win.ini, [windows] "run

registry added:
HKEY_CURRENT_USER\Software\Microsoft DirectX\WinSettings "XP_FW_Disable" 
Data: 1 
HKEY_CURRENT_USER\Software\Microsoft DirectX\WinSettings "XP_SYS_Recovery" 
Data: 1