Name: Worm.Win32.Opasoft. Category: Viruses Description: Details Worm.Win32.Opasoft.s This worm uses accessible network resources to spread throughout local networks. The worm file is 17920 bytes in size and packed using ASPack. The unpacked file is approximately 25KB in size. Symptoms of infection If a file called srv32.exe is present in the Windows root directory, the computer is infected. Propagation When launching, the worm copies itself to the Windows directory as srv32.exe and registers this file in the system registry. [HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun] Srv32 =%windir%Srv32.exe The worm also creates an additional registry key to flag its presence in the system. [HKLMSOFTWAREMicrosoftWindowsCurrentVersionSRV32] The worm attempts to copy itself to the Windows root directory on other computers in the local network. It then modifies the win.ini file to ensure that it gains control when the system is rebooted. Payload The worm attempts to connect to the site of a Ukrainian mobile services provider http://sim-sim.com and send an SMS containing the IP address of the victim machine to 8-050-196XXXX.