Windows Forum

Ask something
Discussion Locked

Nimbda Virus

0 helpful
11 replies

by milesrrs

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hi everyone
i have had this rotten virus, downloaded the removal tool from mcafee and after running it a few times, finally seemed to get rid of it.
I have run this tool and NAV and both report no virus's.
Since then twice i have had NAV come up saying it found the nimbda virus in a file. Both times is while i was connected to the net via a dial up connection. And both times in files called TFTP266 (or similar) with no file extension.....

does anybody know what these files are and where they come from as i deleted them and they seem to reaapear

regards

Adrian

11 replies

by quahsays

as far as i'm aware, the safest bet for you to totally be rid of nimbda is to reformat, and reinstall windows,...nimbda modifies certain system files, so you'll never really know which file is affected.

by quahsays

as far as i'm aware, the safest bet for you to totally be rid of nimbda is to reformat, and reinstall windows,...nimbda modifies certain system files, so you'll never really know which file is affected.
of course, make sure you have put in the correct patches after re-installation before connecting to the "outside" world.

by ciscofred

Try going here http://www.ca.com/virusinfo/encyclopedia/
do a search for Nimda.
Download Nimda System Recovery Utilities (ZIP)
I don't know if this is the same one you have tried but it's worth a shoot. I have not used this because we are fully protected with CA AntiVirus Software for now. Knock on wood! Hope this helps and good luck!

by kep 001

Adrian,

There is a very good article and discussion going on at:

https://www.techrepublic.com/article.jhtml?id=r00220010920mco01.htm&fromtm=e101-5

Among others,

Symantec's removal tool:

http://securityresponse.symantec.com/avcenter/venc/data/ w32.nimda.a@mm.removal.tool.html

and one at CNET:

http://download.cnet.com/downloads/0-10093-100-7249328.html

and one at Central Command:

Http://Centralcommand.com

As always, remove any spaces that may occure in the URLs because of the reformatting.

Also, don't willy nilly remove riched20.dll. While it may be infected, it may not and is used by WordPad I believe.

Good luck,
Kep

This discussion is closed to new replies.