W32/Draggdor Worm

 Information about the W32/Draggdor Worm:

W32/Draggdor is a worm. The worm will infect Windows systems and spreads by copying itself to local folders and network drives.

Upon execution, the worm copies itself as services.exe in the Windows folder. It also copies (Random).exe to all folders on local and network drives.

The worm modifies registry at the following location to load itself during each startup.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\Currentversion\Windows

The worm terminates a security related processes named ccApp.

It also opens a back door on the compromised computer by connecting to the following URL:

http://s.dragon128.net/ie2007/ie/log(Removed)

It awaits for commands from an attacker to perform the following actions:

Download and execute remote files
Change the Microsoft Internet Explorer home page

This worm first appeared on August 1, 2006.

 Other names of W32/Draggdor Worm:

This Worm is also known as W32.Draggdor.