Worm/Opasoft.AA - Worm

See also

Full description

Alias:	W32/Opaserv.worm [McAfee], W32/Opaserv-A [Sophos], Win32.Opaserv [CA], WORM_OPASOFT.A [Trend], Worm.Win32.Opasoft [AVP], W32.Opaserv.Worm
Type:	Worm
Size:	28,672 Bytes
Origin:
Date:	00-00-0000
Damage:	Spreading over unprotected net resources.
VDF Version:	6.23.00.00
Danger:	Low
Distribution:	Medium

DistributionIt tries to spread over unprotected net resources.

Technical DetailsWhen activated, Worm/Opasoft.AA checks for 'ScrSvrOld' in the registry entry:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
If present, the related file is deleted. If not, the worm checks for 'ScrSvr' in the registry entry:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
If this is not present, the worm enters:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run ScrSvr
%WinDIR%\ScrSvr.exe

Next, the worm checks if the file %windir%\ScrSvr.exe was run. If not, the worm copies itself in this file and makes the registry entry:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run ScrSvrOld

After controlling the registry and the place of its activity, the worm ensures that it has only one version in system memory, using a Mutex named ScrSvr31415.

If not yet activated, the worm registers as process, on Windows 95/98/Me. On Windows NT/2000/XP it has at its disposal a priority for the worm process .
Then, the worm contacts the network and looks for "C\" resources. For every resource found, the worm is copied in Windows\Scrsvr.exe.
The worm uses a security vulnerability of Microsoft Windows 95/98/Me. It sends single password characters to the network resource for accessing other Windows 95/98/Me files, without knowing the password.
The affected systems are:
Microsoft Windows 95
Microsoft Windows 98
Microsoft Windows 98 Second Edition
Microsoft Windows Me

It creates C:\Tmp.ini, that contains the text 'run= c:\windows\scrsvr.exe'.

It looks like the worm is able to update itself, reading files from a website.
It also tries to download a file named Scrupd.exe.

See a brief description here.

Description inserted by Crony Walker on Tue, 15 Jun 2004 14:00 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back