Hi Guys, I work for a computer repair company, and I've seen this virus in at least 4 sites. After reading the copious notes on here (cheers, guys!) I went to one of them and applied the security patch, put a password on the shares and waited... It took about 5 minutes for one machine to get re-infected. I *re*-applied the security patch. Double checked the password was set. Waited... 5 minutes - back again! Being on a customer site I couldn't sit there all day playing with this, so I unshared the drive and that's all she wrote. No more infections. The other two PCs at the same site responded to the patch the first time around. Has anyone else had similar problems of the patch not working even after re-applying it? And yes, I did re-boot all the time when installing the patch. TIA Kev.

The patch should work...remember, after you disconnect all the shares, you have to clean ALL computers from this critter before you hook the shares back up again...

I know it *should* work... :-D Do you know how I can tell if it *is* working? Short of waiting for a virus infection to happen? I suppose I could try viewing the drive from another computer on the network with just supplying the first letter of the password and see if that lets me in or not. Is there any other way? File dates, times, sizes, etc? Any idea *why* it doesn't install the first, second or subsequent times? And yes, I did clear the other machines off before putting this one back on the network. The other machines are still clean. Cheers, Kev.

Ha! I found out why the patch didn't work, the damn thing was corrupt and was only extracting half of the files. Nice of it to tell me while I was installing it, eh? I tried extracting the individual files of the patch using winzip and that complained. I downloaded a fresh copy of the patch, and winzip extracted them nicely. The files it patches are: QFECheck.exe, 36864, 27/7/1998 QFECheck.hlp, 8042, 9/2/1996 vserver.vxd, 112912, 11/10/2000 (win 98) 15/9/2000 (win 98SE) I hope that helps someone else. Kev.

http://www.f-secure.com/v-descs/opasoft.shtml

*Perhaps* i found the file that download the other files from internet! if you find a file called A~NSISu_.exe delete it!

I checked the following registry keys and reset the set ones to zero. Cleaned the virus files (scrsvr tmp.ini, win.ini etc) dropped the fire wall and waited. The virus didn,t return. Check them out and try it if they set. [HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Class\NetTrans\0000 to 0004]