Troj/Natas-A will attempt to repeatedly logon to a predefined server.
The dropper of Troj/Natas-A drops the Trojan into %windows%\plugin\csrss.exe
and sets the following registry entry:
HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\[random clsid]\
Stubpath = %windows%\plugin\csrss.exe