W32/Cassel is a worm. The worm will infect Windows systems and spreads by copying itself to removable drives.

Upon execution the worm creates Lcass.exe in the Windows System folder.

The worm modifies registry at the following location to load itself during each startup:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

The worm also drops a clean file named mswinsck.ocx in the Windows System folder.

The worm also copies the following files in all removable drives:

[Driver Letter]:\RECYCLER\Lcass.exe
[Driver Letter]:\autorun.inf

It also starts a back door using HTTP, listening on TCP port 88.

The worm then contacts a web-site on the tzhen.3322.org domain.

It then sends the computer name, IP address, the port number of the back door, and other information to the site.

This worm first appeared on July 8, 2007.

 Other names of W32/Cassel Worm:

This Worm is also known as W32.Cassel.