Kozog, DDoS_Kozog, DDoS.Kozog, Kozirog


Kozog is Win32 DDoS (Distributed Denial of Service attack) trojan that was distributed by a hacker (or hackers group) in November 2000. The trojan was sent as email messages with attached file.


Automatic action

Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.

Find out more
Knowledge Base

Find the latest advice in our Community Knowledge Base.

Product Manual

See the manual for your F-Secure product on the Help Center.

Contact Support

Chat with or call an expert for help.

Submit a sample

Submit a file or URL for further analysis.

Technical Details

The message text and header looked like that:

From: World Travel Agency Ltd. [office4@worldtravel.com]
Sent: November 21, 2000 5:31 PM
To: All tourists and vacationist
Subject: Celebrate the New Millenium!
 World Travel Agency Ltd.
 359 BTC Drive
 P.O. Box 134108
 Seattle, WA 98108-23
Dear Sir/Madam
Celebrate the New Millenium! Discover the Paradise!
We offer the most attractive package for the New Millenium celebrations you have ever seen.
Pure nature, modern architecture and high technologies are fused to create the perfect resort.
Reasonable prises, correctness, high quality services.
Click on the zip-file below to see our offer!
Make your neighbours envy!
Best Regards,

The attached file intends to be displayed as ZIP archive, but it is Windows EXE file with the name:

[many spaces]

This is trojan's "installer" that will affect computer if it is run. Because of "[spaces]" trick it will be displayed as .ZIP file in many cases, and that can tempt a user to open it.

When the EXE file (trojan's installer) is run, it extracts from itself two more executable files and copies them to Windows system director with names:


Under Win9x and WinNT these files are registered then in auto-run sections in different ways: under WinNT the trojan registers SOUNDV.EXE file in system registry:

SOFTWARE\Microsoft\Windows\CurrentVersion\Run soundv.exe Under Win9x the DLL file is registered in SYSTEM.INI file in [boot] section:


The trojan then displays fake error message:

A requred DLL does not exist.

(original spelling from a trojan's messagebox).

The SOUNDV.EXE file is the DoS trojan itself. The MRE.DLL is a small program that just executes the SOUNDV.EXE on each run. As a result under both Win9x and WinNT the SOUNDV.EXE component will be activated.

When this file is run (on next Windows restart) it will stay active as hidden application (service), then it enables auto-dial option in Internet settings, then performs DoS attack on the Bulgarian server "kozirog.netissat.net".

Date Created: -

Date Last Modified: -