Nimda files 
Author Message
 Nimda files

I'm trying to delete files related to the NIMDA virus.
But some files such as *.eml and riched20.dll can't
be deleted.  When I'm deleting the *.eml files, the
error message, "File is in use" appears.  In the case
of the riched20.dll, I'm changing the attribute property
from hidden+system but everytime, "Access Denied"
message appears.

Thanks in advance to anyone who can help me.



Sun, 14 Mar 2004 13:27:37 GMT  
 Nimda files


Quote:
> I'm trying to delete files related to the NIMDA virus.
> But some files such as *.eml and riched20.dll can't
> be deleted.  When I'm deleting the *.eml files, the
> error message, "File is in use" appears

have you tried to rename the files, reboot and then delete them ?

Hermann Weiss



Sun, 14 Mar 2004 15:48:27 GMT  
 Nimda files


Quote:
> I'm trying to delete files related to the NIMDA virus.
> But some files such as *.eml and riched20.dll can't
> be deleted.  When I'm deleting the *.eml files, the
> error message, "File is in use" appears.  In the case
> of the riched20.dll, I'm changing the attribute property
> from hidden+system but everytime, "Access Denied"
> message appears.

Try downloading f-prot from www.complex.is - you can use the DOS version
with a bootable floppy disk to clean your computer.

If you are unsure how to make it work in this way you can download a routine
I wrote that is designed to use f-prot to clean nimda but will also work
with most other viruses.

* get 2  blank disks, make them bootable (put each one into the a: drive in
turn, open a dos prompt and type sys a: for the first one, remove it, put in
the 2nd and type sys a: again and voila! 2 bootable floppies!). I'm told
this don't work if you have Windows ME  but I don't know anything about that
to tell you what to do instead.

* Then download nimdanuke.zip from the ftp site ftp://www.lutonsfc.ac.uk -
It's based on f-prot and kills most known viruses dead.

*Open nimdanuke.zip once it's downloaded and you'll find 2 zip files in
there labeled 'disk1' and 'disk2'.

* Extract the contents of 'disk1.zip' to the first bootable floppy we made
in the last paragraph, and the contents of 'disk2.zip' to the second
bootable floppy.

* Read the instructions in the Read_Me.txt file on how to use the 2 disks.
You should read parts 2 & 3 which tell you more about making and using the
floppies.

--
--
Robert Moir, Microsoft MVP
To search the MS Knowledge base use the link below:
http://support.microsoft.com/support/search/c.asp?PSL=1
My Homepage - http://www.robertmoir.co.uk
** Emailed questions will not be answered **



Mon, 15 Mar 2004 03:51:06 GMT  
 Nimda files
Try running in safe mode or from dos.


Quote:



> > I'm trying to delete files related to the NIMDA virus.
> > But some files such as *.eml and riched20.dll can't
> > be deleted.  When I'm deleting the *.eml files, the
> > error message, "File is in use" appears.  In the case
> > of the riched20.dll, I'm changing the attribute property
> > from hidden+system but everytime, "Access Denied"
> > message appears.

> Try downloading f-prot from www.complex.is - you can use the DOS version
> with a bootable floppy disk to clean your computer.

> If you are unsure how to make it work in this way you can download a
routine
> I wrote that is designed to use f-prot to clean nimda but will also work
> with most other viruses.

> * get 2  blank disks, make them bootable (put each one into the a: drive
in
> turn, open a dos prompt and type sys a: for the first one, remove it, put
in
> the 2nd and type sys a: again and voila! 2 bootable floppies!). I'm told
> this don't work if you have Windows ME  but I don't know anything about
that
> to tell you what to do instead.

> * Then download nimdanuke.zip from the ftp site ftp://www.lutonsfc.ac.uk -
> It's based on f-prot and kills most known viruses dead.

> *Open nimdanuke.zip once it's downloaded and you'll find 2 zip files in
> there labeled 'disk1' and 'disk2'.

> * Extract the contents of 'disk1.zip' to the first bootable floppy we made
> in the last paragraph, and the contents of 'disk2.zip' to the second
> bootable floppy.

> * Read the instructions in the Read_Me.txt file on how to use the 2 disks.
> You should read parts 2 & 3 which tell you more about making and using the
> floppies.

> --
> --
> Robert Moir, Microsoft MVP
> To search the MS Knowledge base use the link below:
> http://support.microsoft.com/support/search/c.asp?PSL=1
> My Homepage - http://www.robertmoir.co.uk
> ** Emailed questions will not be answered **



Mon, 15 Mar 2004 10:36:16 GMT  
 Nimda files
McAfee and Norton can remove the whole virus.
The virus still uses the files and needs to be stopped before you delete
those files.

Otherwise they'll come back.
Also look for *.nws files.

Angelo



Quote:
> I'm trying to delete files related to the NIMDA virus.
> But some files such as *.eml and riched20.dll can't
> be deleted.  When I'm deleting the *.eml files, the
> error message, "File is in use" appears.  In the case
> of the riched20.dll, I'm changing the attribute property
> from hidden+system but everytime, "Access Denied"
> message appears.

> Thanks in advance to anyone who can help me.



Wed, 17 Mar 2004 20:50:22 GMT  
 
 [ 5 post ] 

 Relevant Pages 

1. Win32 Nimda.A@mm (dr) and Win32 Nimda.E@mm (dr)

2. W32.Nimda.A@mm and W32.Nimda.enc

3. Nimda/Code Red Log File Entries

4. W32.Nimda.enc

5. NIMDA virus

6. removal of nimda virus

7. Nimda Removal

8. Nimda

9. Nimda Virus

10. nimda

11. NIMDA VIRUS

12. NIMDA

 

 
Powered by phpBB® Forum Software