Είναι ιός ή αρχείο windows? Srv32.exe

[karib]

Υπαρχει ενα srv32 στο pc μου που μου εχει ζητησει πολλες φορες να βγει στο Internet αλλα με το firewall αρνηθηκα.

 

Κανω ενα search στο google, και ειδα οτι ειναι virus.

 

Περιττο να πω οτι σκαναρα το δισκο με ενημερωμενα τα εξης: Kaspersky Antivirus, Adaware, Spybot, Spyware Doctor. Επισης με ειδικο για το srv32 virus removal tool απο την symantec.

Κανενα ομως δεν βρηκε το srv32.exe.

Εγω βρηκα οτι βρισκεται μεσα στον φακελο windows/system32 και ειναι 17kb.

 

Τελικα τι ειναι, ιος ή αρχειο των windows?

[stone]

99% ειναι ενα worm.Πριν καμια εβδομαδα πηγα στο PC μιας φιλης που ειχε προβλημα και το ιδιο αρχειο ζητουσε να συνδεθει στο ιντερνετ.Της εβαλα το McAfee 8.0 updated και το καθαρισε.

[MrTryANalyzer]

Σου παραθέτω το κέιμενο απο το site του αντιβιοτικού RAV

 

Win32/Opaserv.N.worm is a slightly modified variant of the Win32/Opaserv.worm family. The worm is packed with ASPack and its size is about 18KB packed (27KB unpacked).

 

When executed for the first time, the worm will try to remove all the files and registry keys that were initially added by the previous variants of Win32/Opaserv.worm, working this way as an upgrade mechanism. Thus, the worm will try to delete the following files:

"c:\windows\scrsvr.exe", "c:\windows\alevir.exe" and "c:\windows\brasil.exe".

 

The worm will try to remove the following entries: "SCRSVR", "ALEVIR", "BRASIL" from the "Software\Microsoft\Windows\CurrentVersion\Run" registry key and "Srv32" and "Srv32Old" from the "SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices" registry key, as well as the files from the "value" fields corresponding to those registry entries.

 

Then, the worm will copy itself to "Windows" folder as "Srv32.exe" and will add the following entries in the "SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices" registry key: "Srv32" with "windows/Srv32.exe" full path as value, and "Srv32old" with the current executable run path as value. This way the worm will be executed in the background each time Windows starts (this only happens on Windows 9x systems). Then the worm will execute "Srv32.exe" from the "Windows" folder copy of the worm.

 

Win32/Opaserv.N.worm will create and check a mutex called "Srv3231415" to ensure that only one copy of the worm is running in the same time, then will create several threads used in the spreading process.

 

Just like the rest of Win32/Opaserv.worm family, Win32/Opaserv.N.worm will scan the network for computers with port 137 opened (NetBIOS Name Service) and will copy itself on the remote machines in the "Windows" folder. In order to be executed each time the remote computer boots up, the worm will try to modify the "win.ini" file from the remote computer by adding its path under the "run" entry.

 

The worm will also create on the victim's computer several files used in the spreading process: "SrvTsk", "SrvRes", "sccss", and in the windows folder "hstlst", "hlb". Due to its spreading mechanism, Win32/Opaserv.n.worm will probably not spread when executed under Windows NT/2000/XP.

 

 

Evilness: Potentially destructive (corrupts data while replicating)

Analyst: Daniel Bodorin

[karib]

Τελικα το αφαιρεσε το kaspersky. Ευχαριστω παιδια