Home	Forums	What's new	Resources

Somebody help me!!!

slinga - Jan 25, 2002

		slinga	Jan 25, 2002
		Hey guys, I CAN'T GET RID OF THE GODDAM NIMDA VIRUS!! And I if I forget you can kiss my ftp good bye cuz I'm never going to re rip everything. I've been using this program by Symantec that finds the virus, deletes all the *.eml files, but then everything's back when I reboot. What should I do? Any advice...

		Anapan	Jan 25, 2002
		I was going to suggest the symantec tool, but then I read the post again... uh, if that doesn't work, I think trend.com has a different removal tool... http://www.antivirus.com/vinfo/virusencyclo/defaul... And, uh, the symantec one has a bunch of instructions that come with the tool, incase you didn't follow them properly http://securityresponse.symantec.com/avcenter/venc... (Edited by Anapan at 7:01 pm on Jan. 25, 2002)

		ExCyber	Jan 26, 2002
		If you (or the tool) haven't, do the following: - Update Internet Explorer. One of the primary reasons this virus gets spread is due to a really, really, stupid error in IE. - If you're running it, update IIS. - Replace all copies of riched20.dll and mmc.exe with known good versions, preferably from your Windows install disc. - Open up c:windowssystem.ini and look at the "shell" variable. If it reads: Shell = explorer.exe load.exe -dontrunold then change it to: Shell = explorer.exe and delete c:windowssystemload.exe - Make sure you've got the right removal tool - according to Symantec, there are two common versions of W32.Nimda, for which seperate removal tools exist.

		IceDigger	Jan 26, 2002
		get a decent virus scanner trial version. most importantly, scan all html files on your pc (there's a bunch, like manuals, windows pages, etc), as they contain it too and tend to re-infect you.