I have forgotten something:

Bubbel is written in visual basic and shipped with a standard installer, it has the following files
Files:
bubbel.exe
bubbel.bl_
bubbel.sck
bubbel.the
bubbel.bbl
readme.txt

After infection, the files are renamed and placed in windows\sys\
bubbel.bbl to msvbvm50.dll
bubbel.bl_ to msinet.ocx
bubbel.the to bubbel.exe
bubbel.sck to mswinsck.ocx