Tech: SCRSVR.EXE wants to connect?

Subject: Tech: SCRSVR.EXE wants to connect?
From: pavane
Date: 10 Sep 04 - 02:53 AM

I know we have a couple of knowledgable 'catters - so:

I am getting a message from Zonealarm that SCRSVR.EXE wants to connect to the net. Am I right in thinking that

a) This is screensaver
b) If it wants to connect, then the proper one has been replaced by a spyware or virus program?
c) I should not allow it

Thanks

Subject: RE: Tech: SCRSVR.EXE wants to connect?
From: el_punkoid_nouveau
Date: 10 Sep 04 - 03:19 AM

You are partly right with b, and definitely c. The executable file is created by the W32/Opaserv-B virus (and possibly other variants). For more information, see Sophos.com here for more detail of the objectionable little horror.

First step you need to take is to get a good anti-virus solution - Norton, Panda, McAfee and Kaspersky Labs are all reputable - Sophos aims at the business market.

Hope this helps!

Subject: RE: Tech: SCRSVR.EXE wants to connect?
From: pavane
Date: 10 Sep 04 - 04:51 AM

I do have Norton, but not updated lately!

Subject: RE: Tech: SCRSVR.EXE wants to connect?
From: GUEST,Jon
Date: 10 Sep 04 - 05:25 AM

Pavane, just for reference as you are a programmer. A Windows screensaver is an executable file itself. You (as I did once) can write a .exe and change the extension to .scr to create a screensaver. I can't remember the details but there are special requirements in that your executable needs to contain one or more callback functions.

Subject: RE: Tech: SCRSVR.EXE wants to connect?
From: mooman
Date: 10 Sep 04 - 05:30 AM

This is definitely virus or malware/spyware and should be eliminated. If el punkoid's suggestions or the trusty Spybot or Ad-Aware propgrams don't work, drop me a PM as I've had to remove quite a few similar naster little buggers.

Peace

moo

Subject: RE: Tech: SCRSVR.EXE wants to connect?
From: pavane
Date: 10 Sep 04 - 05:47 AM

Difficult to tell how it got IN. Should Zonealarm have stopped it getting in? Or maybe it was in a mail. I usually delete spam without opening it, but sometimes I can't tell. I cetainly don't execute attachments.

Besides, I am using Netscape, not Outlook.

Yes, my C drive is shared for use on our network at home, but I only connect to the net by dial-up. Thought the firewall would deal with that.

Subject: RE: Tech: SCRSVR.EXE wants to connect?
From: treewind
Date: 10 Sep 04 - 06:10 AM

You're right - Zonealarm probably wouldn't have stopped it if it was in an email. At least it's doing the right thing questioning a program that's trying to connect to the net. Too right, if you don't know what it is, you don't want to let it do that!

If you aren't using Outlook, Outlook Express or Internet explorer that's a good start, which leaves a slight mystery as to how it got in, but I don't know how good Zonealarm is, nor how your installation is configured.

No fireall is completely bullet proof, and a software firewall on the machine you are using is particularly vulnerable.

I'm on broadband now with a router that does firewalling and NAT. Before that, on dialup, I used IPCop on a spare PC that was too old for anything else. Having an extra box in the way certainly makes it harder for hackers and malware to get in.

Anahata

Subject: RE: Tech: SCRSVR.EXE wants to connect?
From: GUEST,Jon
Date: 10 Sep 04 - 06:54 AM

Way off this topic but...

Anahata, how do you find your router, etc. combination unit works for you?

I've not had mine (a different unit to yours) long but so far I've been impressed and have found it makes life easier and I think when I eventually add a 3rd box (Linux is my plan again) into the system, I suspect that Win and Linux on things like Internet sharing will be pretty much (although not in the std sense of the term) "plug and play".

To date, I think mine has been one of the better say £60 investments I have made. I'd be interested in your views as to how good you find yours in relation to a small home or even small business network.

Subject: RE: Tech: SCRSVR.EXE wants to connect?
From: treewind
Date: 10 Sep 04 - 07:27 AM

Switching from a PC running IPcop to an ADSL router was incredibly easy - in fact if I'd had the forethought to give the ADSL router the same IP address as the firewall I wouldn't have had to change anything at all on the other PCs in the network. Point to the router for a gateway and for DNS (which it was doing already with IPCop) and that's all there is to it.

The router's a Dynamode 4-port hub/ADSL router comination, bought from SCAN (cheap and cheerful).

On Windows you can use USB to configure it initially (but that's a bad way to use it to connect to the net); on Linux I had temporarily to change some IP addresses so I could talk to it. Set up a handful of settings, reboot, surf and forget.

You are right that Windows and Linux are just the same when connecting to the net through a LAN. And you can set up mail and news servers on a linux box and get your Windows system to use them (I do this with news, haven't done it yet with mail). I've also done shared file systems with Samba (Win-Linux) and NFS (Linux-Linux).

This is at home (two user PCS, one headless server) and the same at work (one file and mail server, about 8 Windows PCXs) both using Plus Net (ISP) and the Dynamode ADSL router. It just works!

I'd recommend getting an ADSL-ethernet router rather than a modem for anyone, even if you're only connecting a single PC to the net. 100Mbit ethernet card and cable costs less than a fiver (Scan again) and you have a separate box doing firewalling for you, that's maybe £15 more than a modem-only ADSL box. Plus if you ever do decide to add a second PC later, you just plug it in and go.

Anahata

Subject: RE: Tech: SCRSVR.EXE wants to connect?
From: GUEST,Jon
Date: 10 Sep 04 - 09:44 AM

Cheers for the info. Have SCAN bookmarked now.

Subject: RE: Tech: SCRSVR.EXE wants to connect?
From: pavane
Date: 10 Sep 04 - 10:25 AM

My PC is a laptop which I use for dial-up to collect email when away from home. So a separate box is not an option.