On XP:

Time: 23:49

There is not any more communications with sites.

There is not any more some internal network browzing.

At 23h29 : all activities were active.

The sample disapeared of the system.

I can conclude 2 things:

1. Or the sample has a bug

2. Or the sample disapeared by itself after some time, to try to be reloaded to access to another external sites

I decided to wait 24h to see if the sample try to be reactivated by itself.

No Schedule Tasks were created, but maybe some trace in memory could stay on hidden mutex processes.

On WIN2003:

At 23h24 : The malware stays active, but i can see that the accesses to external sites, the google parsing and internal netwoks scanning decreased comparing at 24 hours before and seems to be stabilized each 2 hours.

The sample disapeared of the /WINDOWS/SYSTEM32