When the W32.Opaserv.J.Worm runs on Windows 95-/98-/Me-based computers, it does the following:
It checks for the value
in the registry key
If the value exists, the worm deletes the file to which the Srv32Old
If the the Srv32Old
value does not exist, then the worm determines whether the value
exists in the registry key
If the value does not exist, the worm adds the value
to that registry key.
Next, the worm checks whether it is being run as the file C:\Windows\Srv32.exe. If it is not, the worm copies itself as this file name and adds the value
Srv32Old <Path\original worm name>
to the registry key
After the worm checks the registry values and the location from where it is executing, the worm checks to make sure that only one instance of the worm is running in memory. It does this by creating a mutex that has the name Srv3231415
The worm registers itself as a process if it is not already executing.
Then, the worm takes inventory of the network looking for "C:\" shares. For each share that it finds, it copies itself to C:\Windows\svr32.exe.
The worm uses a security vulnerability in Microsoft Windows 95/98/Me. It sends single-character passwords to network shares to get access to Windows 95/98/Me file shares, without knowing the entire password assigned to the shares. The affected operating systems include:
- Microsoft Windows 95
- Microsoft Windows 98
- Microsoft Windows 98 Second Edition
- Microsoft Windows Me
A patch for computers that run these operating systems can be found at http://www.microsoft.com/technet/security/bulletin/MS00-072.asp.
The worm is apparently coded to add the following line to the Win.ini file:
However, in actual infections or detections, the worm does not add this line to the file Win.ini.
The worm appears to be able to update itself by reading files from a Web site whose URL is hard-coded into the worm. The worm attempts to download an update named Sccss.
The W32.Opaserv.J.Worm also has Backdoor capabilities, which give an attacker unauthorized access to a compromised computer. The worm opens a randomly chosen TCP port and UDP port to connect to the attacker.
Symantec Security Response encourages all users and administrators to adhere to the following basic security "best practices":