Win32/Nimda.E Worm

 Information about the Win32/Nimda.E worm:

Nimda.E is a variant of Win32/Nimda.A worm. It is a mass mailing email worm. This worm will infect Windows systems as well as computers installed with IIS servers. Nimda.E also spreads over network shares.

Click here to download the FREE utility (CleanND.EXE) to detect and remove the Win32/Nimda.A and Win32/Nimda.E worm from your computer.

TThe worm arrives with a random subject carrying an invisible attachment SAMPLE.EXE. When the infected mail is opened or previewed under Microsoft Outlook or Microsoft Outlook Express, the worm gets activated.

The worm copies itself into Windows System folder as LOAD.EXE and RICHED20.DLL. These files will be hidden. Later on the worm modifies SYSTEM.INI by adding a line shell=explorer.exe load.exe -dontrunold to activate itself during next windows startup. The worm copies itself as HTTPODBC.DLL under root of C:, D: and E: drives.

The worm then modifies .htm, .html and .asp files on the local drives with a JavaScript. When these files are opened with Internet Explorer, Microsoft Outlook or Microsoft Outlook Express, it downloads readme.eml, and infects the user's system.

The worm copies itself as CSRSS.EXE and tries to spread through the network shares. It also creates .NWS and .EML files on the network shares. It creates a network share with no password on all the local drives of the infected computer. This would allow easy propagation of worm across network.

The worm body contains the following text

"Concept Virus (CV) V.6 Copyright(C) 2001, (This's CV No Nimda.)".

This worm first appeared on 29th October 2001.

 Other names of Win32/Nimda.E worm:

This worm is also known as W32/Nimda.E, Troj_Nimda, PE_Nimda.E.

 Removing Win32/Nimda.E worm from your computer:

You can remove this worm from your computer by using Protector Plus antivirus software.