scrsvr.exe

Tnx, AnnMarie
I did as you suggested and the computer booted up without a hic-up and no reference to the quanantined files. I now have 2 copies if this file in my quarantine folder. It showed up again after I was able to quarantine it the first time.
Thanks, again.

You also need to do a search of your registry for scrsvr and delete the key you find. Check windows\applog folder for a scrsvr file and you will also find a tmp.ini file in the root directory of c: that should be deleted.

I recreated a blank tmp.ini file in C: after deleting that one and it seems to keep the worm from executing on rebooting the computer.

Are you running WinMx by any chance?

mawil and others with the "W32.Opaserv.Worm ",

Symantec (Norton) just came out with a W32.Opaserv.Worm Removal Tool . You can read the directions and download it at the link below.

http://securityresponse.symantec.com...oval.tool.html

HTH
Tufenuf

Symantec was pretty quick. Wasn't long after the fist link
http://securityresponse.symantec.com...serv.worm.html
was posted that they added some registry info to it and removed the recommendation about tmp.ini

Almost not worth reversing it now that I have some time :(

OK This is getting old. Got home from work and checked windows directory. No scrsvr.exe. Read the new info at symantec site and checked the registry and the files they mentioned were not there. Nothing in win.ini either.

Just to be safe I ran symantec's removal tool. It said it deleted scrsvr.exe in windows directory and nothing from registry.

Then I found an opasoft key and a scrsvr key in another location in the registry and deleted them. (Sorry. Didn't think to check the exact location.)

A bit later, I checked windows directory again and scrsvr.exe was back. Also the reference in win.ini - run=C:\WINDOWS\SCRSVR.EXEc:\windows\scrsvr.exe.

(NOT the one mentioned at symantecs website.)

Have rebooted and nothing new is added to registry and nothing is trying to get past ZA.

How do I get rid of this *&*&^%$# thing?

Oh. I also went to Computer Associates and downloaded their newest signature file that is supposed to detect the opasoft infection. It found nothing and I even scanned the scrsvr.exe by right clicking on it.


EDIT: Also upon rebooting computer, I get messages that the call in win.ini cannot find scrsvr.exe. So apparently the thing is not actually running. It's just THERE. :(

mawil, I had the following on an e-mail from CA.

Win32.Opaserv.Worm

Win32.Opaserv is a worm that spreads through shared Windows drives. When run, the worm copies itself to the Windows directory. It then adds the following value to the registry so that this copy is run each time Windows starts:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ScrSvr="%Windows%\ScrSvr.exe"

It also creates this registry key value that is set to the file from which worm was originally run:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ScrSvrOld="ScrSvr.exe"

This registry key is later deleted.

The files ScrSin.dat and ScrSout.dat are also created in the %Windows% directory.

Win32.Opaserv attempts to copy itself over the network through open share directories to WINDOWS\scrsvr.exe on a remote Windows machine.

The worm also attempts to update itself by downloading a copy off a webserver. The file that is downloaded is named scrupd.exe.

The eTrust InoculateIT signature updates listed below contain detection and system cure for Win32.Opaserv.Worm.

To cure an infected system, all files being detected as Win32.Opaserv.Worm must be deleted. This can either be done manually or by setting eTrust InoculateIT to delete infected files.

If you already saw this just disregard.

Tufenuf

Ran eZtrust AV with the newest updated file. It's not finding anything, but the scrsvr.exe file keeps coming back. :(

I've scanned all drives with it and run Symatec's removal tool.

Thing is, the scrsvr.exe doesn't seem to be doing anything. Just keeps coming back to my windows directory and the win.ini file.

W32.Opaserv.Worm

Look at it this way, it's not as bad as a Trojan like KLEZ!

mawil, Do you by chance have the file that's mentioned in this paragraph from the CA Removal Instructions.

The worm also attempts to update itself by downloading a copy off a webserver. The file that is downloaded is named scrupd.exe.

I don't know what else to say but there are a lot of people at different forums I frequent having problems getting rid of this virus. If I find a definite solution I'll post back to this thread.

Tufenuf

mawil, Response 26 at the link below may have the solution. It has worked for others at that thread. Here's the link.

http://www.computing.net/security/ww...orum/2430.html


Good Luck,
Tufenuf

Thanks Tufenuf . Read thru it and checked msconfig startup. Nothing there. It's getting late and I'm really bleary eyed. :) Will read thru it again tomorrow and try a few things.

Oh. I just restored an earlier version of my registry because every time I did a search of it for scrsvr or opasoft, I found something new. (Different locations. Different files.) Will give it some time and see if it affected anything.

Have you disabled file and print sharing in network yet (till you get rid of it) ?

Hi
Having had this virus since the 30th of September I am nearly at my wits end. I have looked everywhere for a solution. Although Norton, McAfee, etc have posted their solutions, nothing seems to prevent it recurring.

Everything mentioned in the previous posts I have tried and the only thing I can see that works is to remove the shares. As mentioned in post 41
After removing all the shares on my PC, the virus stopped completely.

I believe this virus is scanning any computer on the internet for open network shares. Once it finds a share on a windows root drive, it writes the scrsvr.exe file and then modifies the win.ini file.

Hey presto, the next time to boot up the virus runs. When you connect to the internet, your machine starts scanning the internet for other machines with open ports to infect them.

So, as long as you are sharing your root drive, you are vunerable. If you have a fixed IP, the the virus probably stores your address for targeting again.

That is my conclusion, in the absence of any other ideas.
My guess is the only way to use shares is to employ a decent firewall to prevent penetration or too turn write off permissions on the shares.

This gets stranger and stranger.:) After restoring a previous registry, IT came back again. After a reboot, it didn't seem to be DOING anything. Not trying to access the net or lan.

So, being totally fed up, I double clicked on it. It immediately tried to pass thru ZA. I then ran symantec's fix again, with different results this time.

It deleted the executable, cleaned a registry entry AND said I was now innoculated (I think that's the word it used) against the virus. I then cleaned the call from the win.ini file, searched the registry and removed all scrsvr and opasoft entries that were left.

The bloody thing came back, but it is 0KB in size and there is nothing in win.ini or the registry.

If anything changes, I'll post back.

I HAVE DEFINITELY GOT RID OF IT!!!!!

Go to your internet settings, then the properties of your tcp/ip protocol and disable the 'Client for Microsoft Networks' & 'File and printer sharing for Microsoft Networks' bindings.

I am on a 2 machine network with a shared 'c' drive on one machine (the one with the problem). I can still access my shared c drive and my printer!

For 3 hours i have been scrsvr.exe free and my win.ini file is untouched.

For more info see http://grc.com/su-bondage.htm


YIPPEEEEEE!!!!!!:D

Was watching a movie last nite and came back to the computer. I have my AV (eTrust) set for real time protection now. Message on screen that scrsvr.exe contained the opasoft virus. Now it's back to 28KB and in the win.ini file again. Nothing in regisrtry. Right clicked on the file and scanned with eTrust, it deleted the file. I also deleted the win.ini line AGAIN. This is all while the computer was running continuously without rebooting and with ZA running. (I have cable connection.)

This thing is really persistent.

SO. After reading the thread in Tufenuf's link, I did the following.

Went to dos and created a scrsvr.exe file, copied it to windows directory and made it read only. Been surfing all day and no more problems.

I know this is only a workaround and plan to implement Muk1wa's fix as soon as I have time.

Thanks for everyone's help. :D

Hi friends,
I hope my bad English be understood.
I don't know if the scrsvr is a solved problem.
When I'm connected, every 5-10 minutes my NAV2002 detect an infected file .... c:\windows\scrsvr.exe.
My win.ini now is very light. Yes I have a new line run=C:\WINDOWS\SCRSVR.EXEc:\windows\scrsvr.exe but I dont find remainder. I have [windows]-[compatibility]-[embedding]-[desktop] only. Nothing [fonts], [intl] etc...
The printers aren't recognized, Corel Draw don't start, Autocad don't print etc..
In the HKEY_LOCAL_MACHINE I don't see nothing...

HELP !!!

(sorry for my English) Here it's midnight.
Thankx
Giovanni:(

Hi

I had this problem for 2 days and have been pulling my hair out, but it has now gone. I am scrsvr.exe free!!!!

Please see my post above for fix...

Muk1wa

You must remove the shares or change access to them to read only.

I have shares all over my PC and set them all to read only.

Since that, I have never had any problems.

This virus scans you machine for writeable shares and if it finds that your windows directory is shared with write access, it writes the exe file to this folder. Then it modifies the win.ini file.

YOU MUST REMOVE THE WRITEABLE SHARES> THIS DEFINITELY WORKS.

Thanks Muk1wa,
How can I find the internet setting you are talking? I works with Win98 and IE 4.0. I sow http://grc.com/su-bondage.htm but I didn't find nothing.

Thanks Asp,
What are the shares in a PC?
How can I remove the writeable shares?

Thanks and sorry for my computer knows.

greetings from Italy

To access shares.

Win 98
Goto start > Run
Type "Explorer" into field (without quotes)

If any of the drives have a Blue hand holding the icon, then it is shared.

Simply right click on it and select sharing.

http://www.pc-help.org/news/scriptworm.htm

This link explains how worms works

scrsvr.exe is spreading in exactly the same fashion

I don't have this bugger yet but I've been doing some searches on it. A couple of things I've found indicate it's propagating thru the NetBEUI port (port 139). Manually closing this port supposedly stops it. Another trick is to create a fake scrsvr.exe text file in your C:/windows folder. I'm running w2k so I suppose I would put it in C:/WINNT. (correct me if I'm wrong here)

I haven't had to deal with it yet so these are untested by me.

I created a fake scrsvr.exe file in windows folder and made it read only. Worked for me. :)

Quote:

---

Originally posted by DVOM
I'm running w2k so I suppose I would put it in C:/WINNT. (correct me if I'm wrong here)

---

The file uses a hard coded c:\windows\scrsvr.exe path so you won't get it under 2k.

Just curious. Did you recently just download a trial version of a screen saver? Could the screen saver be trying to call home for some registration purposes?

Edit: Very good IMM my bad 2:39am toronto, ontario.

viralmenace The subject is this worm
http://securityresponse.symantec.com...serv.worm.html

It would be a strange way to register - installing itself on any other machine it can :)

IMM, thanks for that. I was just trying to figure out how to protect our w2k network at work. Apparently I don't have to. The only 98 machine we've got doesn't have any shares set.

PLEASE NOTE

Although it works for this virus when you create a read only file called scrsvr.exe in your windows directory, it won't work for future viruses. YOU ARE BETTER TO REMOVE THE SHARES, MAKE THEM READ ONLY OR DEPENDS ON PASSWORD.

All it takes is for someone to recomplie this virus to use a different filename and all you people who created the read only scrsvr.exe file are shafted.

This is from http://service2.symantec.com/SUPPORT...00091415173339
---------
If you do not want to disable file and print sharing

1. Double-click My Computer on the Windows desktop.
2. Right-click drive C, and click Sharing. If you do not see Sharing, stop here.
3. Look at Sharing status:
If Not Shared is checked, stop here.
If Shared As is checked, we recommend that you disable this option by checking
Not Shared.
If you must share this volume, then under Access Type check either Read-Only or
Depends on Password.
You can create separate passwords for read-only and full access. Give the Full
Access Password only to those who need it.
For all other shared files and folders, make sure Access Type is set appropriately.
---------

Never share the root (unless you REALLY know how to protect it).

ACK !!!! I ran samantec's fix it found the thing and repaired it. But I stillset a boot up message asking for the scrsvr.exe. I checked the reg and win.ini file also and found nothing. An y ideas how to stop windows from asking for this file ?

Do Start > Run > Win.ini

You will find the EXE on the Run= line
Replace it by just
Run=

Save, exit and reboot

As I said I had already done that I ended up doing this fix thanks to a previous post fromTufenuf I obtained this fix here http://www.computing.net/security/ww...orum/2430.html
Reboot to DOS Type in: Edit and then Press Enter
(If you have a good boot disk this will bring up a small application that will allow you to make a fake scrsvr file and keep the virus from duplicating itself again.)
A blue screen will appear. Press Alt and F at the same time. Use your arrow keys to move down and highlight Save As in the menu that appears. Press Enter.
Type in: scrsvr.exe in the window that appears next. Then use Tab to get to the Save button and press Enter again.
Then you're back to the blue screen. Once again Press Alt and F at the same time. Use your arrow keys to move down and highlight Exit in the menu that appears. Press Enter.
You should now be back to the black and white screen.
Type in: attrib +r c:\windows\scrsvr.exe
Press enter. The fake scrsvr you created now can't be deleted or overwritten by the virus. You're done in Dos, so turn off your computer, remove the boot disk, and reload to Windows.
You will probably see a little message saying "You are using Selective startup for troubleshooting". Just click the check box on this and click ok so that you won't have to see it anymore. It is just talking about the first step you did when you changed MSCONFIG.
Open Notepad (look for it in your Start Menu, under Programs > Accessories).
Click on the File menu, then on Open. A window pops up. Next to "Files of Type" at the bottom of the screen, click on the down arrow and select "All Files". Then browse your computer to get into the Windows folder on C drive. Find a file called Win.ini and open it. On my computer there was a line near the top that was set to load scrsvr.exe when the computer started. It looked like "C:\Windows\scrsvr.exe" and I just deleted it right out of there. Then click File, and Save. Exit this program.
Click on Start button again, then on Run. Type in REGEDIT and hit enter. Click on the Edit menu in the window that comes up, and then on Find. Type in scrsvr in the box and then click on Find Next button. It will locate scrsvr in your Registry, all you have to do is right click on it and delete it. Close this window when you're done.

Thanks again Tufenuf.:D