Alias:Trojan.Win32.OpaKill.a, W32/Opaserv.worm, W95/Opaserv.worm.F, W32.Opaserv.K.W
Type:Worm 
Size:28,672 Bytes or 32,256 Bytes 
Origin: 
Date:00-00-0000 
Damage:Spreading over unprotected network resources. 
VDF Version:6.23.00.00 
Danger:Low 
Distribution:Low 

DistributionIt tries to spread over unprotected network resources.

Technical DetailsWhen activated on Windows 95/98/Me computers, Worm/Opasoft.G checks for 'ALEVIROld' in the registry entry:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
If present, the related file is deleted. If not, the worm checks for 'ALEVIR' in the entry:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
If not present, the worm makes the registry entry:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
ALEVIR C:\WINDOWS\ALEVIR.exe
ALEVIR C:\WINDOWS\ALEVIR.pif

Then, it checks if the file C:\Windows\ALEVIR.exe or C:\Windows\ALEVIR.pif has been activated. If not, the worm is copied into the file and registers:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run ALEVIR

After controlling the registry and the place of its activity, the worm ensures that it has only one version in system memory, using a Mutex named ALEVIR.
If not yet activated, the worm registers as a process.
The worm uses a security vulnerability of Microsoft Windows 95/98/Me. It sends single password characters to the network resource for accessing other Windows 95/98/Me files, without knowing the password.
The affected systems are:
Microsoft Windows 95
Microsoft Windows 98
Microsoft Windows 98 Second Edition
Microsoft Windows Me

It creates C:\Put.ini, that contains the text
'run=c:\Windows\ALEVIR.exe,c:\Windows\ALEVIR.pif'.

It looks like the worm is able to update itself, reading files from a website.
It also tries to download a file named ALEVIR.exe.
Descripción insertada por Crony Walker el martes 15 de junio de 2004

Volver . . . .