We have a client who found the Nimda.A virus on there server (during a chance virus scan). During the scan, 99 infected files were found and automatically deleted. After the scan was completed, I went down there with some information about this virus which I had found on the Internet.
I looked at everything and anything that this piece of document mentioned and found that it looked as though this virus hadn’t done anything yet. It looked like it was deleted before it could do any damage.There was also a file I could have run which was meant to undo any damage Nimda had done, but since it appeared as though it hadn’t done any damage, i didn’t run this file.
A week later, this client rings me to say they can’t get on the internet. I find that in the Internet Management Console, FTP, Gopher, WWW and web proxy aren’t running. So I try to start them all but they all come up with an error that ‘the specified module could not be found’. I then find out that the client had done another virus scan that previous morning and found the Nimda virus again and it was auto deleted (yet again). But it was from this time that after the server was rebooted that these services wouldn’t start again. I am now wondering if the Nimda virus could have done this or if it is something entirely different and just purley a coincidence.
Either way, does anyone have any suggestions. Thanks for your help.
