W32/Opaserv is a network worm. This worm attempts to spread across open network shares. This worm infects Windows systems.

Upon execution of the worm, it copies itself as ScrSvr.exe to Windows folder. It modifies the registry at the following location to load itself during the next startup.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

After this worm attempts to spread on the network. It checks for write access on the remote systems in the network. If write access is enabled then it tries to alter RUN under WIN.INI of the remote system to load itself during next startup. It also tries to copy itself as ScrSvr.exe under Windows folder of the remote system.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

The worm tries to connect to a website to download the latest version of the worm.

This virus first appeared on 30th September 2002.

Other names of W32/Opaserv worm :

This worm is also known as WORM_OPASOFT, Worm.Win32.Opasoft, W32.Opaserv.Worm