Find a Partner
This window is encrypted for your security.
Need help? Ask the community or hire an expert.
Go to Avira Answers
Worm.Win32.Opasoft.p, W32/Opaserv.worm, W32.Opaserv.AD.
Spreads over unprotected network resources.
It tries to spread over unprotected network resources.
When activated on Windows 95/98/Me computers, Worm/Opasoft.Q checks for 'SRV32Old' in the registry entry:
If present, the related file is deleted. If not, the worm checks for 'SRV32' in the entry:
If not present, the worm makes the registry entry:
Then, it checks if the file C:\Windows\SVR32.exe or C:\Windows\SVR32.pif has been activated. If not, the worm is copied into the file and registers:
After controlling the registry and the place of its activity, the worm ensures that it has only one version in system memory, using a Mutex named SVR32.
If not yet activated, the worm registers as a process.
The worm uses a security vulnerability of Microsoft Windows 95/98/Me. It sends single password characters to the network resource for accessing other Windows 95/98/Me files, without knowing the password.
The affected systems are:
Microsoft Windows 95
Microsoft Windows 98
Microsoft Windows 98 Second Edition
Microsoft Windows Me
It creates C:\Put.ini, that contains the text
It looks like the worm is able to update itself, reading files from a website.
It also tries to download a file named SVR32.exe.
Description inserted by Crony Walker on Tuesday, June 15, 2004