Is the Nimda worm destructive to data and/or program files? We have noticed that the attack replicates existing filenames with the extensions *.eml, *.nws and riched20.dll in every directory on an infected system (or infected share). Are the original files being deleted, or are these replicated files simply copies? The Nimda-created files don't appear in the original directory, they appear to be placed randomly on the share.
Nimda has caused original files to be hidden and renamed with the _ (underscore) character in front of them, similar to a companion virus infection. Some users report that EXE files have been corrupted on infection.
While Nimda does not seem to be deliberately damaging, it still has the potential to cause many problems.
This Content Component encountered an error
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.