The Opaserv-D is a variant of the Opaserv-A Worm. The Worm spreads through network shares. A file called Marco!.Scr will be created in the Windows subdirectory (folder) once the worm is executed.

• Run REGEDIT and delete the entry:
  
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\cronos=Windows\marco.scr
  • Then Click on 'Edit' (top bar). Click on 'Find'. Find and Delete any entry that contains these keywords:
    
    • Alevir*.*
    • Marco*.*
    • AleSout*.*
  
  
• Click on "Start","Run". Type "EDIT C:\WINDOWS\WIN.INI" (for Windows 95,98) or Type "SYSEDIT C:\WINDOWS\WIN.INI" for Windows ME
  Delete these lines:
  • run= c:\Marco!.Scr
    
  • run= c:\temp.ini
    
  Save WIN.INI and Exit.
  
  
• Boot up with a clean DOS Diskette.
• Run VBUSTER.EXE : -
  • Press F1. Press S.
    Search for and Delete these files:
    c:\temp.ini
    Alevir*.*
    Marco*.*
    put.ini
  • Scan your harddisk using V-Buster.
    Delete all infected files.

Return Home