A virus has attacked our entire network system today known to be as Nimda. It has create a file called Win32:Nimda [Drp] in our project folders and all internal folders. The anti viruses are claiming that our code files are infected and are trying to delete them. We don't see any unusual code dump in our code files. Unfortunately, we dont have the backup of the recent code as well. It is creating .eml files in every folder and our computers have become very slow. We have tried a hand ful of anti-viruses but nothing seems to have worked so far. Please advice an anti-virus we could use in this situation.
Thanks,
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
astpak,
It is very doubtful that you actually have any variant of the 'nimda' virus - unless there is a brand new variant that I haven't heard of.
All AV applications have been protecting against that for years, MS published the patches to prevent that from spreading in about 2004, and it cannot infect a local host unless the user is running with 'Administrator' privileges.
What application is telling you that you have "Win32:Nimda [Drp]" on your systems?
Try F-secure removal for Nimda
ftp://ftp.f-secure.com/ant
To disinfect the worm and restore security of affected workstations, please follow these instructions:
1. Disable all network sharing or temporarily kill the network. This is a _must_ as the worm uses the network to spread itself.
2. Scan _all_ files (not just files with selected extensions) on all local hard drives and clean all infected EXE files using F-Secure Anti-Virus and the latest updates. It is recommended that you use one of the latest FSAV versions to remove infection.
3. Delete or rename (if not possible to delete instantly) all non-disinfectable or locked files including worm droppers (typically 57kB in size):
MMC.EXE (in Windows directory)
LOAD.EXE (in Windows' system directory)
ADMIN.DLL (in root folder of all local hard drives)
RICHED20.DLL (in all folders on all local hard drives)
All *.EML and *.NWS files (typically 79kB in size) that are
detected as infected with Nimda should be deleted. Note that
you might have clean EML files as well, for example if you've
saved e-mails to file from Outlook Express, so only delete
files that FSAV detects as infected.
If an infected file is locked by Windows, complete disinfection, exit to pure DOS or boot your system with a clean system diskette and rename/delete the file manually. In case of NT/2000 based system the locked file(s) should be renamed with a non-executable extension to ensure that it doesn't start when Windows is booted next time.
4. Restart a system. Do not connect it to the network yet. It is advised to scan all files on all local drives with FSAV again to ensure that there are no more infected files in a system.
5. Locate SYSTEM.INI file in your Windows directory and open it with Wordpad or Notepad. Replace the string "shell=explorer.exe load.exe -donotloadold" with "shell=explorer.exe" string.
6. Delete all files with .TMP extensions from your local temporary directories - typically \Temp\ or \Windows\Temp\ or \documents and settings\username\local settings\temp.
7. Copy a clean RICHED20.DLL file to \Windows\System\ or \WinNT\System32\ folders. This DLL file is used by many applications and they won't run if this DLL is missing. You can locate a clean RICHED20.DLL file from a clean Windows machine, or extract it from Office 2000 CD with this command:
EXTRACT /A r:\office1.cab riched20.dll /L c:\windows\system
8. Remove all shares from all local hard drives and renew these shares with correct access rights if needed. This needs to be done because the worm affects shares security. Check especially the \\localhost\c$ share rights.
9. Remove 'Guest' account and renew it with correct access rights and group placement ('Guest' account should not be in 'Administrators' group).
10. Check all *.HTML, *.ASP, and *.HTM as well as files that have 'DEFAULT', 'INDEX', 'MAIN' and 'README' words in their filenames for the small JavaScript code referring to README.EML file and remove it or restore the affected files from a backup. This JavaScript code is located in the very end of affected files.
11. When cleaning a webserver from Nimda, the CodeRed II backdoor infections should be removed as well. Please refer to 'CodeRed' description and cleaning instructions.
http://www.europe.f-secure
12. Correct Windows Explorer's settings concerning displaying of hidden files and certain extensions if necessary as the worm makes Explorer to hide certain files and extensions.
13. Restore network connections only after all workstations are disinfected or the worm will re-infected already clean computers!
--
Ref Website
http://www.f-secure.com/v-
I also recommend that you download Mcafee stinger.
http://vil.nai.com/vil/sti
Restart to safe mode and run stinger, and that should disinfect your PCs.
Not me.
Upload the code file that its detecting as a threat onto www.virustotal.com. What does your code do, out of interest?
FWIW - 'nimda' cannot infect any version of Windows XP running I.E. 6.0 or above.
The patch for all versions of Windows was pushed out back in 2001 (MS01-020).
I maintain what I said in my first comment and strongly suggest that this was a false positive - which happens with about all anti-malware applications.
moh10ly,
You've been an EE Expert long enough to know that copying and pasting a solution for another site is against the guidelines.
If you want to refer to someone else's work the preferred method is to post the link with a brief description of it, and don't copy and paste the whole article as well.
Thank you.
rpggamergirl
Zone Advisor - Virus & Spyware
To be honest, I never thought of reading the user agreement since I subscribed in 2002.. though a lot of new rules and conditions have been added to this website lately and I have no intention to break any user agreements.
Thanks for warning me .. i'll take the time to read the user guide of the site.
Mohammed J.H
Business Accounts
Answer for Membership
by: A2the6thPosted on 2009-08-21 at 06:10:09ID: 25151399
symantec has a downloadable nimda removal tool that you can try. Here is the link
http://www.symantec.com/se
Cheers