W32.Nimda - sample.exe

tasklist.org		A comprehensive list of processes running in your computer
		tasklist \| attachlist

bookmark this website!		total tasks: 16297

AttachList is a list of email attachment files that viruses usually send in email. It contains the attached file names, typical subjects and messages, the name of the viruses that send them, and instruction on how to remove these viruses.

most requested

Browse attachlist by file name:

| a | b | c | d | e | f | g | h | i | j | k | l | m | n | o | p | q | r | s | t | u | v | w | x | y | z |

Name: W32.Nimda

Sender:

Varies.

Subject:

Varies.

Message:

Will ask you to download a file with a .eml extension.

Attachment:

readme.exe
sample.exe

Comments: A worm that attacks IIS web servers. Can be delivered by emailor infected web sites.

Symptoms:


 Varies quite a bit depending on the variant.  One of the variants
for example (Nimda.R) will add the user Guest under the groups,
Guests and Administrators, giving the guest account Administrative
privileges.  Nimda.A opens the C drive as a network share.

Recommended Cleanup Software: We found that Easy SpyRemover is the most effective tool for removing this file.

Manual Removal Instructions: Run LiveUpdate to make sure that you have the most recent virus definitions.
Do one of the following:
If you are running Windows NT/2000/XP, skip to the step where you restart the computer.
If you are running Windows 95/98/Me, edit the System.ini file as follows:
Click Start, and then click Run.
Type the following, and then click OK:
edit c:\windows\system.ini
The MS-DOS Editor opens.
Locate the line that begins with shell=\
Position the cursor immediately to the right of the equal sign.
Press Shift+End to select all the text to the right of the equal sign, and then press Delete.
Type the following text:
explorer.exe
The line should now look like:
shell=explorer.exe
NOTE: Some computers may have an entry other than Explorer.exe after shell=. If this is the case and you are running an alternative Windows shell, change this line to shell=explorer.exe for now. You can change it back to your preferred shell after you have finished this procedure.
Click File, click Exit, and then click Yes when you are prompted to save the changes.
Restart the computer.
NOTE: When your computer restarts, it is likely that infected files will be found. We recommend that you attempt to repair the infected file. Quarantine any file that is not repairable.
Start Norton AntiVirus and make sure that it is configured to scan all the files. For more information, read the document, "How to configure Norton AntiVirus to scan all files."Scan your system with Norton AntiVirus. For more information, read the document, "How to run a full system scan with Norton AntiVirus."
For each file detected as infected by W32.Nimda.A@mm or W32.Nimda.A@mm (html), choose Repair. Quarantine any file that is not repairable.
For each file detected as infected by W32.Nimda.A@mm (dr), W32.Nimda.enc, or W32.Nimda.A@mm (dll), choose Delete.
Restore Admin.dll and Riched20.dll from a backup, or from the Microsoft Windows or Office .cab files if necessary.
Remove unnecessary shares.
Delete the guest account from the Administrators group, if applicable.