Security

Ask something
Discussion Locked

NIMDA VIRUS

0 helpful
9 replies

by lmcdonald 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

We contracted the NIMDA virus a couple months ago. It was removed using the FIXNIMDA tool from all our users. I have an IP Share device on our NT Server (4.0) which enables everyone to access the internet through the external NT modem. We also run a Novell Server that is also networked with the NT server. After running the FIXNIMDA, I have several users that the virus keeps recurring on. One user in particular keeps getting the recurring Word and Excel (Office 2000) problems that this virus creates. This is not a person that normally uses email or the internet. I know I must be missing something. I can run the FIXNIMDA until the virus is removed, then run the DLL extract and everything will be fine. Sometimes for a couple days, sometimes for a couple hours. Does anyone have a clue how I can permanently rid this computer of the virus?

Thanks for the help!
lmcdonald@wickett-craig.com

9 replies

by dklippert

I always start out by searching for and renaming any Normal.dots on the machine (there should be only one).
Try replacing Riched20.dll (a hidden file)in the System folder, from the installation CD.
Part of the Nimda infection is to place Riched20.dll in network shared folders. When you try to open a Word,Excel, etc. file from the shared folder, Nimda is activated.

by robert.marsh

Besides the aforementioned NORMAL.DOT and RICHED20.DLL, if you have ANY computer that has IIS, right-click and open with Notepad all HTM files, scroll to the bottom and see if you have a line referrring to 'README.EXE". Also, at the user's station,MANUALLY REMOVE ALL "mep*.*", "*.eml", and *.htm" files. And, since you have become familiar with the size of the DLL files, recheck THEM manually and replace them.

Also, Check the registry on any Win OS system for references to the above file types and the readme.exe file. If found, remove them. And check in the same manner on the Novell box.

That oughta do it.

This discussion is closed to new replies.