Madrid, October 1, 2002 - Panda Software has reported two new worms, called
Opaserv (which spreads through shared network drives), and Bugbear. Although
Opaserv (W32/Opaserv) only appeared a few hours ago, it is already fourth in
the ranking of the most frequently detected viruses by the free, online
scanner Panda ActiveScan.
Opaserv has a large capacity to spread through networks, making it
particularly dangerous in corporate environments. Its main aim is to infect
other computers, especially those connected to a network. In order to
spread, it uses a file called "SCRSVR.EXE", and is activated when this file
is run. It also copies itself -under the name ScrSvr.exe- to the Windows
directory of the affected computer, going memory resident. In order to
ensure that it is run whenever the computer is restarted, it creates an
entry in the Windows Registry. Finally, it is worth highlighting that
Opaserv tries to connect to a Web address.
The second worm, Bugbear (W32/Bugbear), is designed to send itself out in a
file attached to an e-mail message. The name of the attachment and subject
and message of the e-mail are variable. This malicious code can open port
36794 in the computer under attack and, at the same time, stop applications
such as antivirus programs and personal firewalls. As a result, the worm
opens a backdoor that could allow an attacker to access a remote computer or
network.
