Results 1 to 5 of 5
  1. #1
    3 Star Lounger
    Join Date
    Dec 2001
    Location
    Norland, Ontario, Canada
    Posts
    347
    Thanks
    3
    Thanked 0 Times in 0 Posts

    W32.Opaserv.worm

    I am using Win98SE and Norton System Works 2002. The W32.Opaserv.worm keeps recurring. I have run the Symantec Removal Tool several times and get reports "no infection found."I have also run complete system virus scans and "one Button Checkup" All indications are for a CLEAN system and yet while doing other work, offline or online makes no difference, the Norton "Cannot Repair" warning pops up. I then Quarantine the file as recommended but then have to put up with the Alert notices each time I boot up. If I deletet the file then other problems regarding missing files are announced.
    I have TWO Questions please: #1 How can I rid my system of this problem?? #2 Why doesn't Norton BLOCK the Worm BEFORE it infects my files? Thank you all evry much.

  2. #2
    Uranium Lounger
    Join Date
    Mar 2001
    Location
    New Jersey
    Posts
    6,684
    Thanks
    1
    Thanked 11 Times in 11 Posts

    Re: W32.Opaserv.worm

    Are you on a network ?? If so you could be getting reinfected over the network.
    A Google search for W32.Opaserv.worm took me here where it says this..

    Information about the W32/Opaserv Worm:
    W32/Opaserv is a network worm. This worm attempts to spread across open network shares. This worm infects Windows systems.

    Upon execution of the worm, it copies itself as ScrSvr.exe to Windows folder. It modifies the registry at the following location to load itself during the next startup.

    HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentV ersionRun
    After this worm attempts to spread on the network. It checks for write access on the remote systems in the network. If write access is enabled then it tries to alter RUN under WIN.INI of the remote system to load itself during next startup. It also tries to copy itself as ScrSvr.exe under Windows folder of the remote system.

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentV ersionRun

    The worm tries to connect to a website to download the latest version of the worm.

    This virus first appeared on 30th September 2002.
    Other names of W32/Opaserv worm :
    This worm is also known as WORM_OPASOFT, Worm.Win32.Opasoft, W32.Opaserv.Worm
    <IMG SRC=http://www.wopr.com/w3tuserpics/DocWatson_sig.gif>

  3. #3
    3 Star Lounger
    Join Date
    Dec 2001
    Location
    Norland, Ontario, Canada
    Posts
    347
    Thanks
    3
    Thanked 0 Times in 0 Posts

    Re: W32.Opaserv.worm

    Thanx Doc. No I am not on any network. I did find on the Symantec home page a link to a MS patch for this virus(worm) Q273991. Have downloaded and installed it and will see what happens now. While doing that I got hit with another, w.32HLLW.ULTIMAX. It infected the WindowsStartMenu]ProgramsStartuprdve.exe
    Don't knowwhat to do about that one so I was able to swap hard drives and Ghost a good drive over it. But can you tell me WHY NORTON is NOT detecting and BLOCKING these invaders before they infect a file. WHAT do I have Norton for?

  4. #4
    Uranium Lounger
    Join Date
    Dec 2000
    Location
    Los Angeles Area, California, USA
    Posts
    7,453
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: W32.Opaserv.worm

    Hi PaJan:
    I don't have Norton in front of me, & haven't looked at the options for some time. However, IF you have up-to-date definitions and it's not working, make sure your options are set correctly. i.e. make sure that you're set to scan on opening or running any program, that you aren't excluding programs, that you have AutoProtect running, that you scan the bootdrive when starting up, etc.

    Cheers,

  5. #5
    Uranium Lounger
    Join Date
    Mar 2001
    Location
    New Jersey
    Posts
    6,684
    Thanks
    1
    Thanked 11 Times in 11 Posts

    Re: W32.Opaserv.worm

    Hey PaJan,
    Phil took the words right outta my mouth. If your definitions are up to date and your setting are all correct, that "should" take care of the problem. The only thing I can add at this point is that if you are not running a firewall I would recommend one. The personal version of ZoneAlarm is <img src=/S/free.gif border=0 alt=free width=30 height=15> and covers all the bases. It appears that this worm calls home and ZA would prevent that and let you know it is trying. Hope this helps and that your new install is running clean and clear. If so, format that other drive and the worm it contains into cyber he**.
    <IMG SRC=http://www.wopr.com/w3tuserpics/DocWatson_sig.gif>

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •