Is the Nimda worm destructive to data and/or program files? We have noticed that the attack replicates existing filenames with the extensions *.eml, *.nws and riched20.dll in every directory on an infected system (or infected share). Are the original files being deleted, or are these replicated files simply copies? The Nimda-created files don't appear in the original directory, they appear to be placed randomly on the share.


    Requires Free Membership to View

Nimda has caused original files to be hidden and renamed with the _ (underscore) character in front of them, similar to a companion virus infection. Some users report that EXE files have been corrupted on infection.

While Nimda does not seem to be deliberately damaging, it still has the potential to cause many problems.


This was first published in September 2001

Join the conversationComment

Share
Comments

    Results

    Contribute to the conversation

    All fields are required. Comments will appear at the bottom of the article.