Win32/Nimda.A Worm

 Information about the Win32/Nimda.A worm:

Nimda is a mass mailing email worm. This worm will infect Windows systems as well as computers installed with IIS servers. Nimda also spreads over network shares.

Click here to download the FREE utility (CleanND.EXE) to detect and remove the Win32/Nimda.A worm from your computer.

The worm arrives with a random subject carrying an invisible attachment readme.exe. The content of the mail will be blank. When the infected mail is opened or previewed under Microsoft Outlook or Microsoft Outlook Express, the worm gets activated and tries to propagate in different modes.

The worm copies itself into Windows System folder as LOAD.EXE. Later on the worm modifies SYSTEM.INI by adding a line Shell=explore.exe load.exe -dontrunold to activate itself during next windows startup. It copies itself as ADMIN.DLL under root of windows installed drive. The worm then modifies .HTM, .HTML., and .ASP files on the local drives with JavaScript that causes readme.eml, created by the worm to be loaded by Internet Explorer(ver. 5.1 or above) and Outlook Express. The worm overwrites MMC.EXE with itself and infects the exe files, entries present under the following registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths

It replaces the original Riched20.DLL file with worm infected riched20.dll. The worm gets executed whenever Microsoft Word application is activated.

After this the worm tries to spread through the network shares by infecting .EXE files and by overwriting .NWS and .EML files. It creates a network share with no password on all the local drives of the infected computer. This would allow easy propagation of worm across network.

It mails itself to email addresses present in .HTM and .HTML files of local computer, it also spreads using email addresses under MAPI messages of Microsoft Outlook and Microsoft Outlook Express.

This worm first appeared during September 2001.

 Other names of Win32/Nimda.A worm:

This worm is also known as W32/Minda@MM, Troj_Nimda, Code Rainbow, Minda, Nimbda

 Removing Win32/Nimda.A worm from your computer:

You can remove this worm from your computer by using Protector Plus antivirus software.