Written in Microsoft Visual C++, protected with SVKP

Origin: China

more versions

dropped files on Win98:
c:\WINDOWS\All Users\Start Menu\Programs\StartUp\dx32cxlp.exe    size: 234.496 bytes 
c:\WINDOWS\SYSTEM\dx32cxconf.ini                                 size: 17 bytes 
c:\WINDOWS\SYSTEM\dx32cxlp.exe                                   size: 234.496 bytes 

port (XP): 33370, 33373, 9082 TCP
	
Added to registry (XP):
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_DX32CXEL
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SVKP
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\dx32cxel
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SVKP
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_DX32CXEL
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SVKP
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dx32cxel
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SVKP

Added to registry (98):
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer "mutexname"
data: fKGKESA 

HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer "vers"
data: 4D, 00, 01, 00 

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run "devsec"
data: C:\WINDOWS\SYSTEM\dx32cxlp.exe 

attempts to connect to an IRC server (XP)

tested on Windows XP & 98
January 02, 2005