Security

Ask something
Discussion Locked

W32.Nimda Problem

0 helpful
10 replies

by jnatoli

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
We were hit with the Nimda virus. We shut down the network, fixed the workstations last night, ran the symantec antivirus on workstations this morning and did full scan. We have been cleaning up our servers by runing norton antivirus and manually deleting the .eml, nws file extension. However once we clean a partiton out and move to another one when we go back to the original partition, there are more files with the .eml extension. Norton is also finding infected files and deleting them butI am not sure if this is triggering a reocurrance or if there are other files we are missing in the clean up process. The only thing I noticed we are not doing yet is rebooting the computer and then running the scan again. We are doing this now. Any advice would be helpful

10 replies

by Former member

I don't know if this helps but Symantec does have detailed info at the following site

http://www.symantec.com/avcenter/venc/data/w32.nimda.a@mm.html

Their removal instructions are:
1. Run LiveUpdate to make sure that you have the most recentvirus definitions.
2. Start Norton AntiVirus (NAV), and make sure that NAV is configured to scan all files. For instruction on how to do this, read the document How to configure Norton AntiVirus to scan all files.
3. Run a full system scan.
4. Ifany files are detected as infected by W32.Nimda.A@mm or W32.Nimda.A@mm (html), click Repair.
5. If any files are detected as infected by W32.Nimda.A@mm (dr) or W32.Nimda.A@mm (dll), click Delete.
6. Reboot the computer.
7. Repeat steps 1-6 above until no more files are detected as W32.Nimda.A@mm.
8. Delete the following text from the Shell= entry in system.ini: load.exe -dontrunold
9. Remove unnecessary shares.
10. Delete the guest account from the Administrators group (if applicable)

by turambar386

Nimda actively searchs for open network shares and creates readme.eml files on any shares it can. The fact that you clean a partition and it gets more eml files means that there is at least one system on your network that is currently running the worm.

This is going to be a tough job, but your best bet is to go to each workstation/server, unplug the network cable, and run the anti-virus program to get rid of Nimda. Once all systems are disinfected, ONLY then can you go and plug the cables back in.

One other thing you want to keep in mind is that the worm activates the Guest account on all infected machines and adds it to the Administrators group. You will no doubt want to fix this if the removal tool doesn't do it for you.

Good luck!

by curacao_dejavu

answer 1 is totally correct.
However you have to take additional measures if you don't want to get infected again.

If you are using IIS 4 or 5 you have to patch the servers also against those vulnerabillities.
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/ms00-078.asp

and 2 install the patch so any attachment won't run automatically or upgrade the IE to 5.01 sp2 or IE 6.

http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS01-020.asp

a smaller action could be to disable the preview pane of outlook or change the security setting of ourlook to high.

cnet:"
In addition to its ability to cross between servers and PCs, the Nimda worm seems to be more virulent because it automatically executes in Microsoft's Outlook e-mail software under the program's "medium" security setting."

regards,

Leopold

by jnatoli

Actually one of my coworkers did this and we are already in the process of doing sp2 for IE5.5. I appreciate everybodys input. I am closing the question since it seems we are already doing what is being suggested.

by gmscne

One point wasn't mentioned. This virus replicates onto shared drives. It will share a drive where there was none shared before. As soon as delete and remove the eml from temp, and you clean a PC, and before you plug it back into any network, remove the write permission from any shared drive. Or stop sharing the drive until all are done.
You HAVE to do this!

This discussion is closed to new replies.