|
|
Worm.Win32.Opasoft. Viruses Information
| Name: |
Worm.Win32.Opasoft. |
| Category: |
Viruses |
| Description:
|
Details
Worm.Win32.Opasoft.s
This worm uses accessible network resources to spread throughout local networks.
The worm file is 17920 bytes in size and packed using ASPack. The unpacked file is approximately 25KB in size.
Symptoms of infection
If a file called srv32.exe is present in the Windows root directory, the computer is infected.
Propagation
When launching, the worm copies itself to the Windows directory as srv32.exe and registers this file in the system registry.
[HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun]
Srv32 =%windir%Srv32.exe
The worm also creates an additional registry key to flag its presence in the system.
[HKLMSOFTWAREMicrosoftWindowsCurrentVersionSRV32]
The worm attempts to copy itself to the Windows root directory on other computers in the local network. It then modifies the win.ini file to ensure that it gains control when the system is rebooted.
Payload
The worm attempts to connect to the site of a Ukrainian mobile services provider
http://sim-sim.com
and send an SMS containing the IP address of the victim machine to 8-050-196XXXX. |
Top Viruses Visited Pages:
Invader. - 239 visits
not-a-virus:RiskWare.Tool.RegPatch. - 73 visits
Worm.P2P.Harex. - 66 visits
not-a-virus:RemoteAdmin.Win32.RAdmin.2 - 60 visits
Small.58. - 56 visits
Coito.64 - 54 visits
I-Worm.Mapson. - 48 visits
Win32.Hidra - 43 visits
Win16.Klon.1177 - 42 visits
Marine.500 - 35 visits
Random Viruses Pages:
7son.25
Capicua.51
Apri
Worm.P2P.Surnova.
Win32.Kal
Macro.Word.Laz
Tiso.94
HeyHunter.108
Dalian.136
Mururoa.3449.
|
|
