Thats weird. Spybot detected the opaserv worm on my computer. Adaware and NAV did not find anything. When I went to C:\windows there was no file called scrsvr.exe. I read that it installs that file, then removes it. So that could be an explanation. Weird thing is, this worm is only supposed to affect Win9x and I have XP. So whats going on? A false positive?
Two things... It, according to this page at symantec http://securityresponse.symantec.com...serv.worm.html can infect xp and 98... and if it was quarantined by spybot then it would no longer show up as being in the windows directory. Try looking in the spybot quarantine file for it or do a system file search for scrsvr.
If you still don't find anything then maybe it was a false positive.
Also, look in your win.ini fle..... from symantec..
The worm is apparently coded to add this line to the Win.ini:
run= c:\tmp.ini
However, in actual infections or detections, the worm is adding the line run= c:\ScrSvr.exe.
It's quarantine folder is called "recovery" and is within it's own program folder.. it probably isn't created until something is actually placed there.
If it still isn't corroborated let spybot quarantine it so you can examine the alleged virus file (& find out what it's called if not scrsvr, as well) and decide if it's a false positive. You can always return it later if it is.
Spybot says that it can only do it in after a restart because its in use or in a process or something like that. I checked my processes and there is nothing weird there. I also did a Symantec security scan, and it says that I am vulnerable on port 5000 which UPnP. I am using ZA Pro. How do I close this port?
If the opaserv removal tool doesn't find the virus and then the online scan doesn't either then there's a pretty good chance it's a false positive... enforced by all the evidence so far.. especially no lines in win.ini.
Coincidence? I think not! I have the exact same problem on my computer at work. Its seems like it detects it only after doing the last update. Is anyone else experiencing this problem.
Reply With Quote
