I can't get this virus off of my PC. I have norton professional 2000. I have gone to their website aznd downloaded their repair tool. it Will not get rid of it! I went through and manually took it per their instructions. It is still there... Please Help!!!

1) If you are on a network with other PCs, disconnect from the network and clean each PC before re-attaching back to the network. The virus spreads through network shares with other PCs. 2) Follow the instructions in the following link at the end of this post as I have performed this w/o any problems. 3) Make sure you hand check the win.ini and registry for the following: * Run regedit and check for: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run "ScrSvr" = %WinDir%\ScrSvr.exe * Check the win.ini for the following and remove: Run= 'C:\WINDOWS\SCRSVR.EXE' 4) Make sure the scrsvr.exe file has been removed from your system Check out the following link for virus info and be sure to apply the Microsoft patch for your Windows system: http://vil.nai.com/vil/content/Print99729.htm

I have done all of this and it just keeps showing up, it is like they haven't found it all because as soon as you hook to the internet with nothing open the lights lite up and then i get a detection from my anti-virus program. I have fought this continually today and just doesnt go away. I checked all of the other computers in my office and find no sign of the virus except this PC. Any othe r suggestions??

Look rather than going digging around your Pc looking for a virus , like 1/2 the people in here tell you .. get a cleaner they make those for a purpose and change the Norton crap its obviously not doing its job if you still have the virus Get a free opaserve cleaner here read this http://www.nod32.com.au/nod32/msgs/opaserv.htm then download this: http://www.nod32.it/tools/OPACLEAN.ZIP clean then see if there is still payload left and clean it up

If you want to read up on it...check out these links. http://miataru.computing.net/security/wwwboard/forum/2954.html http://miataru.computing.net/security/wwwboard/forum/2921.html http://miataru.computing.net/security/wwwboard/forum/2897.html

I've posted this article numerous times on all of the Opaserv topics in this forum. Here it is again, with a few additions: I was one of the lucky ones who got the full blown effect of the Opaserv worm. I had scrsvr.exe, brasil.pif, and then alevir.exe. Norton Anti-Virus would always detect it trying to run, but it could never keep my system clean from it. I followed all of their directions, downloaded all of their tools, downloaded the patch from Microsoft, cleaned out my registry, kept my win.ini file clean, made dummy scrsvr.exe and brasil.pif files with the +r read attribute flag, etc. And the stupid things kept coming back!!! I wrote Norton email after email, telling them that their anti-virus software isn't stopping the virus from getting on my computer. I sent them brasil.pif on October 21, and then finally, on October 25, they listed it as a threat, claiming it was discovered on October 25. Stupid liars. And all the while, the virus kept coming back. Because of all of this, I feel that I have to resort to caps to make the following point =) IF YOU SIMPLY USE NORTON ANTIVIRUS AND DELETE CERTAIN FILES AND REGISTRY ENTRIES THE VIRUS CREATES, THE WORM WILL COME BACK! THE VIRUS USES TO USE PORTS 137-139 ON YOUR COMPUTER TO WORK. YOU MUST CLOSE THOSE PORTS! So, I resorted to closing my ports 137-139 (Turning off NetBIOS), and my computer has not reported a virus for 6 days now. (It used to report it every 15 minutes.) Before, from what I could tell, I could clean the viruses off my system using simple techniques such as removing the lines out of win.ini and my registry. I'd stay virus free until I'd connect to the internet, and then *bang* the viruses were back, sometimes in a new morphed form (brasil.pif or alevir.exe). It appears the virus uses a security flaw in Windows (I'm running win 98), by communicating to your computer through these ports, and by turning off ports 137-139, you fix it. I found a nice site that describes how to turn off these ports in detail, and it has simple to follow steps with handy screenshots. The site is here. https://grc.com/x/ne.dll?bh0bkyd2 Run the "Probe my Ports" test first for kicks, it should show you that your computer is vulnerable in the ports that this virus uses. Next, go to section 5 "Network bondage". That will describe how to turn off these ports. By the way, this shouldn't affect your computer's network connections at all. It just redistributes network commucation in the proper way, and you simply just close off ports 137-139 to those that shouldn't have access to it. Once you do this, the virus should be blocked from coming back every time you connect to the internet. By the way, make sure you also follow all of the tips listed on Symantec about the Opaserv worm. You must clean out your registry, win.ini file, and download the patch from Microsoft. If all of this was too technical for you, then another great solution is to download the free version of ZoneAlarm here: http://download.com.com/3000-2092-10153456.html?tag=lst-0-8 And as for one last side note, it appears that you can't fully remove the virus, you can only suppress it. For example, my ports 137-139 were closed, and I hadn't had a virus report in 7 days as a result. I scanned for the opaserv virus using both of Norton's tools (NAV and FixOpsv.com), and it reported I was virus free. Then I decided to open the ports and connect to the internet to see what happened. *BAM* The virus was back in 5 minutes! And I was on a dialup dynamic IP address! That means the virus waits on the computer, just waiting for open ports and an internet connection. So I closed the ports, and immediately all virus activity stopped again. To sum up, by closing the ports off, you'll just suppress the virus for the rest of your computer's life. Good luck! (email me if you have problems, I'd be happy to help)

And now for the technical followup. You should only read this if you are running on a network: The site I mentioned the above postadvocates using NetBEUI for your internal network. Unfortunately, that can be a pain if you're running a TCP/IP internal network, and you can't switch over to NetBEUI protocol. So I looked for a way to allow me to run a TCP/IP network on a Windows 98 machine while blocking ports 137-139. But, according to grc.com, "the only way to close port 139 is for every single service to be unbounded from every single instance of TCP/IP." What this means is, there is no way to use TCP/IP for an internal network while having port 139 closed! So if you're in this sticky situation, you must put up a firewall. Either ZoneAlarm for your personal computer, or configure your network's firewall. We configured our linux firewall to not allow any outbound communication over ports 137-139, and that did the trick for our office. (As for me, since I take my computer home from our office network to connect to the internet via Dial-Up adapter, I'll have to get Zone Alarm).