Need help? Ask the community or hire an expert.
Go to Avira Answers
Alias:W32.Opaserv.Worm, WORM_OPASERV.E [Trend], W32/Opaserv-C [Sophos], Win32.Opaserv.E [CA], W32/Opaserv.worm [McAfee]
Type:Worm 
Size:24,064 Bytes 
Origin: 
Date:00-00-0000 
Damage:Spreads over unprotected network resources.  
VDF Version:6.23.00.00 
Danger:Low 
Distribution:Medium 

DistributionIt tires to spread over unprotected network resources.

Technical DetailsWhen activated, Worm/OpaSoft.BC checks for 'BrasilOld' in the registry entry:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
If present, the related file is deleted. If not, the worm checks for 'Brasil', in the registry entry:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
If not present, the worm makes one of the registry entires:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run Brasil
C:\WINDOWS\Brasil.exe Brasil
C:\WINDOWS\Brasil.pif

Next, the worm checks if the file C:\Windows\Brasil.exe or C:\Windows\Brasil.pif was activated. If not, it copies itself in this file and makes the registry entry:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run BrasilOld

After controlling the registry and the place of its activity, the worm ensures that it has only one version in system memory, using a Mutex named Brasil31415.

The worm uses a security vulnerability of Microsoft Windows 95/98/Me. It sends single password characters to the network resource for accessing other Windows 95/98/Me files, without knowing the password.
The affected systems are:
Microsoft Windows 95
Microsoft Windows 98
Microsoft Windows 98 Second Edition
Microsoft Windows Me

It creates C:\Put.ini, that contains the text 'run=c:\Windows\Brasil.exe,c:\Windows\Brasil.pif '.

It looks like the worm is able to update itself, reading files from a website.
It also tries to download a file named Puta!!.exe.
Description inserted by Crony Walker on Tuesday, June 15, 2004

Back . . . .