W32/Drowor is a worm. The worm will infect Windows systems.

Upon execution, the worm copies itself as Services.exe in the Windows folder and in a (Random Folder) under Windows System.

It also creates a mutex named w32.trafox.A so that only one instance of worm runs.

The worm modifies the registry at the following location to load itself during each startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"services"

The worm attempts to end the processes whose name contains the following strings:

anti
apvxdwin
avengine
avg
avlite
AVSYNMGR
avup
AVWUPD32
AVXQUAR
ccapp
cclaw
center
debug
firewa
fix
griso
guard
hacker
hex
hijack
iknow
kick
LordPE
navw32
pavprsrv
pavsrv51
procexp
scan
secure
security
sysinter

The worm also attempts to update itself by downloading files from the following locations:

http://indonesianvxzone.cjb.net/indonesian(Removed)
http://vaksin.cjb.net/vaksi(Removed)
http://34refds.cjb.net/34ref(Removed)
http://43ti45s.cjb.net/43ti4(Removed)

The worm searches and deletes the old versions of the following files, if newer versions are available for download. The downloaded files are then saved as the following in Windows System folder:

updater.exe
x0f4rt.de
x0f4rt.xe

The worm searches for and infect files with .scr or .exe extension on all mapped drives.

It avoids infecting files with the extensions .doc, .eml, .htm, .html, .shtml, .txt, .wab and protected system files.

The worm attempts to run an ICMP Denial of Service (DoS) attack using the ping command against the following remote hosts:

www.lc.net.id
lc.net.id
202.133.81.1 - 202.133.81.60

This worm first appeared on December 4, 2007.

 Other names of W32/Drowor Worm:

This Worm is also known as W32.Drowor.B.