Nimda Email Virus

This is a HIGH RISK virus that infects you immediately upon reading the email, if you use Microsoft Outlook or Outlook Express to read email. The infected email can come from addresses that you recognize. It can also infect you when you go to an infected web-site or through network shares.

The infected email message is usually blank with random clips of text for the subject, and attached will be an infected document usually named README.EXE or LOAD.EXE.

Once infected, the virus sends emails under your name to anyone in your address book and various other email addresses. This is one of the first indicators that you have the virus, because you will see envelope icons showing up on your Windows Desktop. It also tries to connect to other machines through the network to infect them. And, it will share various parts of your hard drive allowing others to see your files.

Removal - We are trying to get to faculty and staff on-campus who call as soon as possible to clean the virus.

Central Command, Inc. has released a free Nimda cleaning utility for PC's. Download AntiNimda here, and save it to your Windows Desktop. Next, if you have Windows 95/98/Me, reboot your computer in Safe Mode (hold down SHIFT key the entire duration of the boot). In all operating systems, double-click on its icon on the desktop to run it, and click on the button Select Target and choose C:. Click OK and then click on the Scan button.

Note: This scanner and cleaner does not counteract Nimda's sharing of directories of your files which become open to people on the network to see or delete. For more info, contact MicroSupport.

If you would like to check your machine for any virii, try the Norton AntiVirus Online Scanner It will prompt you a few times with a security warning about installing a little program from Symantec. Choose Yes each time to allow it to function. You will then see it scanning all your files. However, this will NOT clean your computer.

If you have any questions or concerns, please contact MicroSupport@tntech.edu or 372-6315.

More Information:

This page maintained by: Jim Johnson
Last updated: September 15, 2003