Ask the Expert

Files changed by Nimda

Is the Nimda worm destructive to data and/or program files? We have noticed that the attack replicates existing filenames with the extensions *.eml, *.nws and riched20.dll in every directory on an infected system (or infected share). Are the original files being deleted, or are these replicated files simply copies? The Nimda-created files don't appear in the original directory, they appear to be placed randomly on the share.

    Requires Free Membership to View

Nimda has caused original files to be hidden and renamed with the _ (underscore) character in front of them, similar to a companion virus infection. Some users report that EXE files have been corrupted on infection.

While Nimda does not seem to be deliberately damaging, it still has the potential to cause many problems.

This was first published in September 2001

There are Comments. Add yours.

TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
Sort by: OldestNewest

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to: