Desktop

Ask something
Discussion Locked

W32/Nimda

0 helpful
8 replies

by scottf

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

How do I get rid of this virus. I have searched symantec(which is what we use here) and they are working on a solution. I understand Mcafee has a solution but they want me to purcahse it. Is there a way to get rid of it. I have it on over 100 computers at my site.
Thanks,
Scott

8 replies

by dklippert

Here's the information I've received:
"The worm uses the Unicode Web Traversal exploit. A patch and information regarding this exploit can be found at http://www.microsoft.com/technet/security/bulletin/ms00-078.asp.

When the worm arrives by email, the worm uses a MIME exploit allowing the virus to be executed just by reading or previewing the file. Information and a patch for this exploit can be found at http://www.microsoft.com/technet/security/bulletin/MS01-020.asp

Users visiting compromised Web servers will be prompted to download an .eml (Outlook Express) email file, which contains the worm as an attachment.

Also, the worm will create open network shares on the infected computer, allowing access to the system. During thisprocess the worm creates the guest account with Administrator privileges."
(Smartreminders.com)
The CERT advisory number is CA-2001-26 at www.cert.org

by scottf

Thank you for the Information above, it helped me understand and get rid of this virus.

Thanks....Scott

by scottf

I went back to the symantec site and downloaded the fix. It seems to not clean all of the infected files. Some of the computers have to be scanned multiple times to fully get rid of the virus. Also, it is still getting in to our machines but at least we can contain it now. Thanks....Scott

by scottf

Thanks for the info. I found all of this last night. I removed IIS from servers that do not use it I also loaded SPK2 on all machines (looks like it has been patched with sPK2 because you cannot load the patch on a machine that has SPK2). However, we use Lotus Notes for e-mail and now we have millions of *.eml and *.nws files on all of our shares. I went to the Symantec site and looked at their fix and it does not address getting rid of all of these extra files. My Anti Virus server crashed becaues of these viruses and I am in the process of rebuilding it now. I think I have gotten rid of the virus itself (load.exe and the mep*. files) but I still have millions of *.eml and *.nws files left over.

Scott

This discussion is closed to new replies.