I worm/ Opas

[funhousegroup]

Can anyone help me with this. I have a clients PC that is infected.AVG antivirus keeps coming up trying to heal the I-Worm/Opas but no matter wich option I choose(Heal,Deny access, allow access) The computer goes to blank black screen and does not respond. I can go into safe mode but if I delete the infected file(INSTIT.bat) The computer crashes. I replased the file and need to get a patch but cant find one anywhere. The Opaserve fix does not do it. I can not use the PC to get to the internet. Pleeeeeeeaaase help.
Thanks Guys, FH

[david eaton]

Info about the Opaserv worm can be found at
http://www.sophos.com/virusinfo/analyses/w32opaservg.html

Tools for the rmoval re also available at the same site.

I can not use the PC to get to the internet
The tools can be downloaded to a floppy, and run that way.

[Paul Komski]

If Opaserv is on a LAN it will keep reinfecting every 10 seconds or so across the network. So if on a LAN - pull the cable and then go round and run the fix on each PC before reconnecting.

PS Opaserv and bugbear often seem to go round hand in hand - maybe one getting in when the other has disrupted any installed a/v. So no harm to run the bugbear tool as well.

[funhousegroup]

Hey thanks guys. I was able to locate the removal tool and get it off. I was mixed up as to the virus name. Opas.k and Opaserve K.
All is well now. Happy Happy Joy Joy
FH