Somebody help me!!!

[slinga]

Hey guys,

I CAN'T GET RID OF THE GODDAM NIMDA VIRUS!! And I if I forget you can kiss my ftp good bye cuz I'm never going to re rip everything. I've been using this program by Symantec that finds the virus, deletes all the *.eml files, but then everything's back when I reboot. What should I do? Any advice...

 

[Anapan]

I was going to suggest the symantec tool, but then I read the post again...

uh, if that doesn't work, I think trend.com has a different removal tool...

http://www.antivirus.com/vinfo/virusencyclo/default5.asp?VName=PE_NIMDA.A

And, uh, the symantec one has a bunch of instructions that come with the tool, incase you didn't follow them properly

http://securityresponse.symantec.com/avcenter/venc/data/w32.nimda.a@mm.removal.tool.html

(Edited by Anapan at 7:01 pm on Jan. 25, 2002)

 

[ExCyber]

If you (or the tool) haven't, do the following:

- Update Internet Explorer. One of the primary reasons this virus gets spread is due to a really, really, stupid error in IE.

- If you're running it, update IIS.

- Replace all copies of riched20.dll and mmc.exe with known good versions, preferably from your Windows install disc.

- Open up c:windowssystem.ini and look at the "shell" variable. If it reads:

Shell = explorer.exe load.exe -dontrunold

then change it to:

Shell = explorer.exe

and delete c:windowssystemload.exe

- Make sure you've got the right removal tool - according to Symantec, there are two common versions of W32.Nimda, for which seperate removal tools exist.

 

[IceDigger]

get a decent virus scanner trial version. most importantly, scan all html files on your pc (there's a bunch, like manuals, windows pages, etc), as they contain it too and tend to re-infect you.