RE: NIMDA virus Help please
Valencia, What is your anti-virus program? Have you updated it to the latest? Have you followed the guidelines set down by SARC or others to remove EML or NWS files? If your server is infected, STOP all the services or you will not eradicate it. Also, check out the removal tool from http://www.centralcommand.com. Email back if you have questions. Steve Clark Clark Systems Support, LLC AVIEN Charter Member www.clarksupport.com 301-610-9584 voice 240-465-0323 Efax -Original Message- From: Dawson, Valencia [mailto:[EMAIL PROTECTED]] Sent: Wednesday, September 19, 2001 4:13 PM To: NT System Admin Issues Subject: NIMDA virus Help please I will attempt to post another SOS and hope this is delivered this time. After several attempts to get rid of this virus I am still not able to see the back of it. I installed the patches, did various virus scans and still I keep getting the files with the html,nws and enc files being infected. This is happening on the exchange server. The intranet server seems to be clear of viruses but whereas users can access the internet, they cannot access the intranet. The WWW and FTP services have stopped and I cannot restart them. Help please if you get this message. Thank you in advance. http://www.sunbelt-software.com/ntsysadmin_list_charter.htm http://www.sunbelt-software.com/ntsysadmin_list_charter.htm
Re: NIMDA virus Help please
After you have been infected applying the patches and doing a virus scan will not rid your system(s) of the virus. http://microsoft.com/technet/treeview/default.asp?url=/technet/security/topics/Nimda.asp - Original Message - From: Dawson, Valencia [EMAIL PROTECTED] To: NT System Admin Issues [EMAIL PROTECTED] Sent: Wednesday, September 19, 2001 4:13 PM Subject: NIMDA virus Help please I will attempt to post another SOS and hope this is delivered this time. After several attempts to get rid of this virus I am still not able to see the back of it. I installed the patches, did various virus scans and still I keep getting the files with the html,nws and enc files being infected. This is happening on the exchange server. The intranet server seems to be clear of viruses but whereas users can access the internet, they cannot access the intranet. The WWW and FTP services have stopped and I cannot restart them. Help please if you get this message. Thank you in advance. http://www.sunbelt-software.com/ntsysadmin_list_charter.htm http://www.sunbelt-software.com/ntsysadmin_list_charter.htm
RE: NIMDA virus Help please
I use Norton. I did all the updates for the newest virus definitions. According to SARC you should repair the EML, NMS files and it does not repair it. It says it cannot repair them. It deletes the DLL files however but that is about it. I rebooted the server several times. I still have the problem. I will try the tool you suggested and let you know what happens. Thanks -Original Message- From: Clark, Steve [mailto:[EMAIL PROTECTED]] Sent: Wednesday, September 19, 2001 4:18 PM To: NT System Admin Issues Subject: RE: NIMDA virus Help please Valencia, What is your anti-virus program? Have you updated it to the latest? Have you followed the guidelines set down by SARC or others to remove EML or NWS files? If your server is infected, STOP all the services or you will not eradicate it. Also, check out the removal tool from http://www.centralcommand.com. Email back if you have questions. Steve Clark Clark Systems Support, LLC AVIEN Charter Member www.clarksupport.com 301-610-9584 voice 240-465-0323 Efax -Original Message- From: Dawson, Valencia [mailto:[EMAIL PROTECTED]] Sent: Wednesday, September 19, 2001 4:13 PM To: NT System Admin Issues Subject: NIMDA virus Help please I will attempt to post another SOS and hope this is delivered this time. After several attempts to get rid of this virus I am still not able to see the back of it. I installed the patches, did various virus scans and still I keep getting the files with the html,nws and enc files being infected. This is happening on the exchange server. The intranet server seems to be clear of viruses but whereas users can access the internet, they cannot access the intranet. The WWW and FTP services have stopped and I cannot restart them. Help please if you get this message. Thank you in advance. http://www.sunbelt-software.com/ntsysadmin_list_charter.htm http://www.sunbelt-software.com/ntsysadmin_list_charter.htm http://www.sunbelt-software.com/ntsysadmin_list_charter.htm
RE: NIMDA virus Help please
Fdisk -Original Message- From: Dawson, Valencia [mailto:[EMAIL PROTECTED]] Sent: Wednesday, September 19, 2001 4:29 PM To: NT System Admin Issues Subject: RE: NIMDA virus Help please Then what will. I have the recent virus definition files which they said would. -Original Message- From: Peter Pearson [mailto:[EMAIL PROTECTED]] Sent: Wednesday, September 19, 2001 4:18 PM To: NT System Admin Issues Subject: Re: NIMDA virus Help please After you have been infected applying the patches and doing a virus scan will not rid your system(s) of the virus. http://microsoft.com/technet/treeview/default.asp?url=/technet/security/topi cs/Nimda.asp - Original Message - From: Dawson, Valencia [EMAIL PROTECTED] To: NT System Admin Issues [EMAIL PROTECTED] Sent: Wednesday, September 19, 2001 4:13 PM Subject: NIMDA virus Help please I will attempt to post another SOS and hope this is delivered this time. After several attempts to get rid of this virus I am still not able to see the back of it. I installed the patches, did various virus scans and still I keep getting the files with the html,nws and enc files being infected. This is happening on the exchange server. The intranet server seems to be clear of viruses but whereas users can access the internet, they cannot access the intranet. The WWW and FTP services have stopped and I cannot restart them. Help please if you get this message. Thank you in advance. http://www.sunbelt-software.com/ntsysadmin_list_charter.htm http://www.sunbelt-software.com/ntsysadmin_list_charter.htm http://www.sunbelt-software.com/ntsysadmin_list_charter.htm http://www.sunbelt-software.com/ntsysadmin_list_charter.htm
RE: NIMDA virus Help please
Then what will. I have the recent virus definition files which they said would. -Original Message- From: Peter Pearson [mailto:[EMAIL PROTECTED]] Sent: Wednesday, September 19, 2001 4:18 PM To: NT System Admin Issues Subject: Re: NIMDA virus Help please After you have been infected applying the patches and doing a virus scan will not rid your system(s) of the virus. http://microsoft.com/technet/treeview/default.asp?url=/technet/security/topi cs/Nimda.asp - Original Message - From: Dawson, Valencia [EMAIL PROTECTED] To: NT System Admin Issues [EMAIL PROTECTED] Sent: Wednesday, September 19, 2001 4:13 PM Subject: NIMDA virus Help please I will attempt to post another SOS and hope this is delivered this time. After several attempts to get rid of this virus I am still not able to see the back of it. I installed the patches, did various virus scans and still I keep getting the files with the html,nws and enc files being infected. This is happening on the exchange server. The intranet server seems to be clear of viruses but whereas users can access the internet, they cannot access the intranet. The WWW and FTP services have stopped and I cannot restart them. Help please if you get this message. Thank you in advance. http://www.sunbelt-software.com/ntsysadmin_list_charter.htm http://www.sunbelt-software.com/ntsysadmin_list_charter.htm http://www.sunbelt-software.com/ntsysadmin_list_charter.htm
RE: NIMDA virus Help please
Valencia, Norton is releasing a utility that will clean the memory. It's been upgraded to state it has a payload that's memory resident. http://www.symantec.com/press/2001/n010919.html Tool still isn't out as far as I can tell. -Original Message- From: Kevin Lundy [mailto:[EMAIL PROTECTED]] Sent: Wednesday, September 19, 2001 3:28 PM To: NT System Admin Issues Subject: RE: NIMDA virus Help please Fdisk -Original Message- From: Dawson, Valencia [mailto:[EMAIL PROTECTED]] Sent: Wednesday, September 19, 2001 4:29 PM To: NT System Admin Issues Subject: RE: NIMDA virus Help please Then what will. I have the recent virus definition files which they said would. -Original Message- From: Peter Pearson [mailto:[EMAIL PROTECTED]] Sent: Wednesday, September 19, 2001 4:18 PM To: NT System Admin Issues Subject: Re: NIMDA virus Help please After you have been infected applying the patches and doing a virus scan will not rid your system(s) of the virus. http://microsoft.com/technet/treeview/default.asp?url=/technet/security/topi cs/Nimda.asp - Original Message - From: Dawson, Valencia [EMAIL PROTECTED] To: NT System Admin Issues [EMAIL PROTECTED] Sent: Wednesday, September 19, 2001 4:13 PM Subject: NIMDA virus Help please I will attempt to post another SOS and hope this is delivered this time. After several attempts to get rid of this virus I am still not able to see the back of it. I installed the patches, did various virus scans and still I keep getting the files with the html,nws and enc files being infected. This is happening on the exchange server. The intranet server seems to be clear of viruses but whereas users can access the internet, they cannot access the intranet. The WWW and FTP services have stopped and I cannot restart them. Help please if you get this message. Thank you in advance. http://www.sunbelt-software.com/ntsysadmin_list_charter.htm http://www.sunbelt-software.com/ntsysadmin_list_charter.htm http://www.sunbelt-software.com/ntsysadmin_list_charter.htm http://www.sunbelt-software.com/ntsysadmin_list_charter.htm http://www.sunbelt-software.com/ntsysadmin_list_charter.htm
RE: NIMDA virus Help please
I checked too and I have not seen it. Will try the one Steve recommended. I found it. -Original Message- From: David James [mailto:[EMAIL PROTECTED]] Sent: Wednesday, September 19, 2001 4:43 PM To: NT System Admin Issues Subject: RE: NIMDA virus Help please Valencia, Norton is releasing a utility that will clean the memory. It's been upgraded to state it has a payload that's memory resident. http://www.symantec.com/press/2001/n010919.html Tool still isn't out as far as I can tell. -Original Message- From: Kevin Lundy [mailto:[EMAIL PROTECTED]] Sent: Wednesday, September 19, 2001 3:28 PM To: NT System Admin Issues Subject: RE: NIMDA virus Help please Fdisk -Original Message- From: Dawson, Valencia [mailto:[EMAIL PROTECTED]] Sent: Wednesday, September 19, 2001 4:29 PM To: NT System Admin Issues Subject: RE: NIMDA virus Help please Then what will. I have the recent virus definition files which they said would. -Original Message- From: Peter Pearson [mailto:[EMAIL PROTECTED]] Sent: Wednesday, September 19, 2001 4:18 PM To: NT System Admin Issues Subject: Re: NIMDA virus Help please After you have been infected applying the patches and doing a virus scan will not rid your system(s) of the virus. http://microsoft.com/technet/treeview/default.asp?url=/technet/security/topi cs/Nimda.asp - Original Message - From: Dawson, Valencia [EMAIL PROTECTED] To: NT System Admin Issues [EMAIL PROTECTED] Sent: Wednesday, September 19, 2001 4:13 PM Subject: NIMDA virus Help please I will attempt to post another SOS and hope this is delivered this time. After several attempts to get rid of this virus I am still not able to see the back of it. I installed the patches, did various virus scans and still I keep getting the files with the html,nws and enc files being infected. This is happening on the exchange server. The intranet server seems to be clear of viruses but whereas users can access the internet, they cannot access the intranet. The WWW and FTP services have stopped and I cannot restart them. Help please if you get this message. Thank you in advance. http://www.sunbelt-software.com/ntsysadmin_list_charter.htm http://www.sunbelt-software.com/ntsysadmin_list_charter.htm http://www.sunbelt-software.com/ntsysadmin_list_charter.htm http://www.sunbelt-software.com/ntsysadmin_list_charter.htm http://www.sunbelt-software.com/ntsysadmin_list_charter.htm http://www.sunbelt-software.com/ntsysadmin_list_charter.htm
RE: NIMDA virus Help please
As others have stated, once you are infected, it's Game over. Wipe the machine. You should not try to disinfect the machine. From http://www.cert.org/body/advisories/CA200126_FA200126.html: The only safe way to recover from the system compromise is to format the system drive(s) and reinstall the system software from trusted media (such as vendor-supplied CD-ROM). -Original Message- From: Kevin Lundy [mailto:[EMAIL PROTECTED]] Sent: Wednesday, September 19, 2001 3:28 PM To: NT System Admin Issues Subject: RE: NIMDA virus Help please Fdisk -Original Message- From: Dawson, Valencia [mailto:[EMAIL PROTECTED]] Sent: Wednesday, September 19, 2001 4:29 PM To: NT System Admin Issues Subject: RE: NIMDA virus Help please Then what will. I have the recent virus definition files which they said would. -Original Message- From: Peter Pearson [mailto:[EMAIL PROTECTED]] Sent: Wednesday, September 19, 2001 4:18 PM To: NT System Admin Issues Subject: Re: NIMDA virus Help please After you have been infected applying the patches and doing a virus scan will not rid your system(s) of the virus. http://microsoft.com/technet/treeview/default.asp?url=/technet/security/topi cs/Nimda.asp - Original Message - From: Dawson, Valencia [EMAIL PROTECTED] To: NT System Admin Issues [EMAIL PROTECTED] Sent: Wednesday, September 19, 2001 4:13 PM Subject: NIMDA virus Help please I will attempt to post another SOS and hope this is delivered this time. After several attempts to get rid of this virus I am still not able to see the back of it. I installed the patches, did various virus scans and still I keep getting the files with the html,nws and enc files being infected. This is happening on the exchange server. The intranet server seems to be clear of viruses but whereas users can access the internet, they cannot access the intranet. The WWW and FTP services have stopped and I cannot restart them. Help please if you get this message. Thank you in advance. http://www.sunbelt-software.com/ntsysadmin_list_charter.htm http://www.sunbelt-software.com/ntsysadmin_list_charter.htm http://www.sunbelt-software.com/ntsysadmin_list_charter.htm http://www.sunbelt-software.com/ntsysadmin_list_charter.htm http://www.sunbelt-software.com/ntsysadmin_list_charter.htm
RE: NIMDA virus Help please
Ouch. Nothing like virus terrorism. Steve Clark Clark Systems Support, LLC AVIEN Charter Member www.clarksupport.com 301-610-9584 voice 240-465-0323 Efax -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] Sent: Wednesday, September 19, 2001 4:35 PM To: NT System Admin Issues Subject: RE: NIMDA virus Help please As others have stated, once you are infected, it's Game over. Wipe the machine. You should not try to disinfect the machine. From http://www.cert.org/body/advisories/CA200126_FA200126.html: The only safe way to recover from the system compromise is to format the system drive(s) and reinstall the system software from trusted media (such as vendor-supplied CD-ROM). -Original Message- From: Kevin Lundy [mailto:[EMAIL PROTECTED]] Sent: Wednesday, September 19, 2001 3:28 PM To: NT System Admin Issues Subject: RE: NIMDA virus Help please Fdisk -Original Message- From: Dawson, Valencia [mailto:[EMAIL PROTECTED]] Sent: Wednesday, September 19, 2001 4:29 PM To: NT System Admin Issues Subject: RE: NIMDA virus Help please Then what will. I have the recent virus definition files which they said would. -Original Message- From: Peter Pearson [mailto:[EMAIL PROTECTED]] Sent: Wednesday, September 19, 2001 4:18 PM To: NT System Admin Issues Subject: Re: NIMDA virus Help please After you have been infected applying the patches and doing a virus scan will not rid your system(s) of the virus. http://microsoft.com/technet/treeview/default.asp?url=/technet/security/topi cs/Nimda.asp - Original Message - From: Dawson, Valencia [EMAIL PROTECTED] To: NT System Admin Issues [EMAIL PROTECTED] Sent: Wednesday, September 19, 2001 4:13 PM Subject: NIMDA virus Help please I will attempt to post another SOS and hope this is delivered this time. After several attempts to get rid of this virus I am still not able to see the back of it. I installed the patches, did various virus scans and still I keep getting the files with the html,nws and enc files being infected. This is happening on the exchange server. The intranet server seems to be clear of viruses but whereas users can access the internet, they cannot access the intranet. The WWW and FTP services have stopped and I cannot restart them. Help please if you get this message. Thank you in advance. http://www.sunbelt-software.com/ntsysadmin_list_charter.htm http://www.sunbelt-software.com/ntsysadmin_list_charter.htm http://www.sunbelt-software.com/ntsysadmin_list_charter.htm http://www.sunbelt-software.com/ntsysadmin_list_charter.htm http://www.sunbelt-software.com/ntsysadmin_list_charter.htm http://www.sunbelt-software.com/ntsysadmin_list_charter.htm
RE: NIMDA virus Help please
Does this apply to Red Code II as well? -Eric Larsen -Original Message- From: Clark, Steve [mailto:[EMAIL PROTECTED]] Sent: Wednesday, September 19, 2001 1:41 PM To: NT System Admin Issues Subject: RE: NIMDA virus Help please Ouch. Nothing like virus terrorism. Steve Clark Clark Systems Support, LLC AVIEN Charter Member www.clarksupport.com 301-610-9584 voice 240-465-0323 Efax -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] Sent: Wednesday, September 19, 2001 4:35 PM To: NT System Admin Issues Subject: RE: NIMDA virus Help please As others have stated, once you are infected, it's Game over. Wipe the machine. You should not try to disinfect the machine. From http://www.cert.org/body/advisories/CA200126_FA200126.html: The only safe way to recover from the system compromise is to format the system drive(s) and reinstall the system software from trusted media (such as vendor-supplied CD-ROM). -Original Message- From: Kevin Lundy [mailto:[EMAIL PROTECTED]] Sent: Wednesday, September 19, 2001 3:28 PM To: NT System Admin Issues Subject: RE: NIMDA virus Help please Fdisk -Original Message- From: Dawson, Valencia [mailto:[EMAIL PROTECTED]] Sent: Wednesday, September 19, 2001 4:29 PM To: NT System Admin Issues Subject: RE: NIMDA virus Help please Then what will. I have the recent virus definition files which they said would. -Original Message- From: Peter Pearson [mailto:[EMAIL PROTECTED]] Sent: Wednesday, September 19, 2001 4:18 PM To: NT System Admin Issues Subject: Re: NIMDA virus Help please After you have been infected applying the patches and doing a virus scan will not rid your system(s) of the virus. http://microsoft.com/technet/treeview/default.asp?url=/technet/security/topi cs/Nimda.asp - Original Message - From: Dawson, Valencia [EMAIL PROTECTED] To: NT System Admin Issues [EMAIL PROTECTED] Sent: Wednesday, September 19, 2001 4:13 PM Subject: NIMDA virus Help please I will attempt to post another SOS and hope this is delivered this time. After several attempts to get rid of this virus I am still not able to see the back of it. I installed the patches, did various virus scans and still I keep getting the files with the html,nws and enc files being infected. This is happening on the exchange server. The intranet server seems to be clear of viruses but whereas users can access the internet, they cannot access the intranet. The WWW and FTP services have stopped and I cannot restart them. Help please if you get this message. Thank you in advance. http://www.sunbelt-software.com/ntsysadmin_list_charter.htm http://www.sunbelt-software.com/ntsysadmin_list_charter.htm http://www.sunbelt-software.com/ntsysadmin_list_charter.htm http://www.sunbelt-software.com/ntsysadmin_list_charter.htm http://www.sunbelt-software.com/ntsysadmin_list_charter.htm http://www.sunbelt-software.com/ntsysadmin_list_charter.htm http://www.sunbelt-software.com/ntsysadmin_list_charter.htm
RE: NIMDA virus Help please
You'll have to visit http://www.cert.org/ or one of the AV vendor sites. I don't recall. http://www.cert.org/incident_notes/IN-2001-09.html is the link. -Original Message- From: Eric Larsen [mailto:[EMAIL PROTECTED]] Sent: Wednesday, September 19, 2001 3:47 PM To: NT System Admin Issues Subject: RE: NIMDA virus Help please Does this apply to Red Code II as well? -Eric Larsen -Original Message- From: Clark, Steve [mailto:[EMAIL PROTECTED]] Sent: Wednesday, September 19, 2001 1:41 PM To: NT System Admin Issues Subject: RE: NIMDA virus Help please Ouch. Nothing like virus terrorism. Steve Clark Clark Systems Support, LLC AVIEN Charter Member www.clarksupport.com 301-610-9584 voice 240-465-0323 Efax -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] Sent: Wednesday, September 19, 2001 4:35 PM To: NT System Admin Issues Subject: RE: NIMDA virus Help please As others have stated, once you are infected, it's Game over. Wipe the machine. You should not try to disinfect the machine. From http://www.cert.org/body/advisories/CA200126_FA200126.html: The only safe way to recover from the system compromise is to format the system drive(s) and reinstall the system software from trusted media (such as vendor-supplied CD-ROM). -Original Message- From: Kevin Lundy [mailto:[EMAIL PROTECTED]] Sent: Wednesday, September 19, 2001 3:28 PM To: NT System Admin Issues Subject: RE: NIMDA virus Help please Fdisk -Original Message- From: Dawson, Valencia [mailto:[EMAIL PROTECTED]] Sent: Wednesday, September 19, 2001 4:29 PM To: NT System Admin Issues Subject: RE: NIMDA virus Help please Then what will. I have the recent virus definition files which they said would. -Original Message- From: Peter Pearson [mailto:[EMAIL PROTECTED]] Sent: Wednesday, September 19, 2001 4:18 PM To: NT System Admin Issues Subject: Re: NIMDA virus Help please After you have been infected applying the patches and doing a virus scan will not rid your system(s) of the virus. http://microsoft.com/technet/treeview/default.asp?url=/technet/security/topi cs/Nimda.asp - Original Message - From: Dawson, Valencia [EMAIL PROTECTED] To: NT System Admin Issues [EMAIL PROTECTED] Sent: Wednesday, September 19, 2001 4:13 PM Subject: NIMDA virus Help please I will attempt to post another SOS and hope this is delivered this time. After several attempts to get rid of this virus I am still not able to see the back of it. I installed the patches, did various virus scans and still I keep getting the files with the html,nws and enc files being infected. This is happening on the exchange server. The intranet server seems to be clear of viruses but whereas users can access the internet, they cannot access the intranet. The WWW and FTP services have stopped and I cannot restart them. Help please if you get this message. Thank you in advance. http://www.sunbelt-software.com/ntsysadmin_list_charter.htm http://www.sunbelt-software.com/ntsysadmin_list_charter.htm http://www.sunbelt-software.com/ntsysadmin_list_charter.htm http://www.sunbelt-software.com/ntsysadmin_list_charter.htm http://www.sunbelt-software.com/ntsysadmin_list_charter.htm http://www.sunbelt-software.com/ntsysadmin_list_charter.htm http://www.sunbelt-software.com/ntsysadmin_list_charter.htm http://www.sunbelt-software.com/ntsysadmin_list_charter.htm
