F-Secure Virus Descriptions : Desex

NAME:	Desex
ALIAS:	DDoS.Win32.Desex.a

Desex is a DDoS (Distributed Denial of Service) trojan. It can perform a DoS attack on certain servers on Internet. The trojan can be hiddenly dropped to users' computers and then used to perform a DoS attack.

The trojan is written in Visual C++ and its file is packed with UPX file compressor. The packed executable size is 6656 bytes, the unpacked length is 9216 bytes.

Desex trojan attacks the following 3 servers:

 212.7.144.70
 193.219.15.17
 212.7.128.165

To attack these servers the trojan uses certain functions from WS2_32.DLL library:

 WSAStartup
 htons
 inet_addr
 socket
 sendto
 WSACleanup

The trojan contains the following text strings:

 sex
 de

To get rid of the trojan it's enough to delete its file from an infected computer.

[Description: Kaspersky Labs, September 23rd; 2003]