ProRat 1.9.1 Server

Server:
dropped files:
c:\WINDOWS\services.exe             Size: 351,276 bytes 
c:\WINDOWS\system\sservice.exe      Size: 351,276 bytes 
c:\WINDOWS\system32\fservice.exe    Size: 351,276 bytes 
c:\WINDOWS\system32\reginv.dll      Size: 20,992 bytes 
c:\WINDOWS\system32\winkey.dll      Size: 13,312 bytes 

deleted:
c:\WINDOWS\system32\Restore\MachineGuid.txt

added to registry:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run "DirectX For Microsoft® Windows"
data: C:\WINDOWS\system32\fservice.exe 

HKEY_CURRENT_USER\Software\Microsoft\Windows NT Script Host\Microsoft DxDiag\WinSettings "XP_FW_Disable"
    Type: REG_SZ 
    Data: 1 
HKEY_CURRENT_USER\Software\Microsoft\Windows NT Script Host\Microsoft DxDiag\WinSettings "XP_SYS_Recovery"
    Type: REG_SZ 
    Data: 1 

tested on Windows XP
February 24, 2007