sadece instit.bat olarak http://www.av.com da arattım bööle sonuçlar var sen de aramalısın :)
W32.Opaserv.H.Worm is a variant of W32.Opaserv.Worm. It is a network-aware worm that spreads across open network shares. It copies itself to the remote computer as a file named Instit.bat. It is compressed using UPX.
This worm attempts to download updates from www.instituto.com.br, although the site may already have been shut down. Indicators of infection include:
The existence of the files Gustav.sap, Institu.bat, or Institu in the root of drive C. This indicates a local infection (that is, the worm was executed on the local computer).
The existence of the institu file in the root of drive C. This may indicate a remote infection (that is, the computer was infected by a remote host).
The existence of the value
instit C:\WINDOWS\instit.bat
or
GustavVED <Path\original worm name>
in the registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
NOTE: When the worm runs on Windows 95/98/Me-based computers, the worm can spread to other Windows 95/98/Me/2000/NT/XP-based computers through open network shares, but the worm cannot run on Windows 2000/NT/XP.
NOTE: If you are on a network, or have a full time connection to the Internet such as DSL or Cable modem, you must disconnect the computer from the network and the Internet before attempting to remove this worm. If you have shared files or folders, these must be disabled. When you have finished the removal procedure, if you decide to reenable file sharing, Symantec suggests that you do not share the root of drive C. Share specific folders instead. These shares must be password-protected with a secure password. Do not use a blank password.
Also, before doing so, if you are using Windows 95/98/Me, you must download and install the Microsoft patch from
Also Known As: Win32.Opaserv.H [CA], WORM_OPASERV.H [Trend], W32/Opaserv-G [Sophos], W32/Opaserv.worm.k [McAfee]
Type: Worm
Infection Length: 21,504 bytes
Systems Affected: Windows 95, Windows 98, Windows NT, Windows 2000, Windows XP, Windows Me
Systems Not Affected: Macintosh, OS/2, UNIX, Linux
CVE References: CVE-2000-0979