Hello everybody
I’m having some kind of situation here with the Nimda Dropper.
Yesterday I rebooted my system and as I was loging into Windows, I received both a standard error dialog complaining about a missing file (c:\windows\system32\wincfgs.exe) which wasn’t missing, and a handful of Avast! warnings (approximatively one per running processes plus a few ones for local files, all directly and indirectly involved with the running processes).
All the Avast! warnings were complaining about a Nimda [Drp] infection.
I tried to repair the files: they can’t be processed.
I tried to to remove the virus completely, but Avast Cleaner didn’t detect the virus on any of my disk… kind of strange as Avast Home was detecting it everywhere…
I also reveived a warning from windows’s resident file protection, complaining some system files had been replaced with unrecognized version and asked for the XP SP2 disk to be inserted for recovery. (I will have access to this CD in a few hours I hope).
I rebooted after setting up a Boottime scan and disabling System Restore.
During reboot, the scanner found occurences of the virus all over the place.
Repairing failed again, so I asked the boottime scanner to send everything to the chest…
it got so many of them that after a while the scanner told me there wasn’t enough space anymore, so I opted for ‘no action’ as I didn’t want to delete permanently the infected files without further investigation.
When the system booted I received my warnings again (missing file dialog + avast! complaining about all the running processes & al.).
I tried Avast cleaner again, without any more luck than before: it found nothing.
But something had definitely changed… I couldn’t launch IE anymore, and a lot of my other applications can’t be started anymore.
some actions trigger strange behaviors from different applicaitons (copying files in the windows’ file explorer triggers an error dialog from my ATI Control Center saying the script engine is obsolete), and I once in a while receive the same warning from windows complaining about the system files’ being unrecognized.
I tried a few other virus removal tools I found on the net designed specially for Nimda, some of them found a few things, some didn’t, but after reboot everything was still sending alerts.
I went to Safe Mode after another reboot and tried different removal tools. Avast wouldn’t launch itself, nor would the avast cleaner.
I tried the removal procedures under my different administrator accounds.
Some of the removal tools I had wouldn’t even work or were apparently being killed during execution.
After reboot and back to standard mode in XP, I had no access anymore to Avast (it doesn’t displayu any error dialogs… it just doesn’t start. I can try to launch whatever binary comes with Avast, cursor changes into the ‘waiting’-one for a few secs and then nothing. No avast-related process in task manager, absolutely nothing), other applications still can’t start either.
Does anyone have any idea here ?
I thought that maybe moving all the files to the chest weren’t the most clever thing to do but didn’t really have a choice. the funny thing now is that I don’t have access to the chest as Avast won’t launch itself.
So far the only removal tool I tried that had some kind of effect was Coling McKenzie’s Anti-Nimda Virus Killer, which removed a lit of Nimda-related files (which apparently confirms that I’ve been infected by Nimda, and that it wasn’t a false positive, in case I would have any remaining doubts …) but wouldn’t clean everything.
(strange thing also: on one of my partition, which has only a few files and directories, McKenzie’s tool keeps finding files and directories it skips, and nothing else… it looks like it’s looping indefinitely and can find an infinite amount of files/directories where I have almost none)
I’m really lost and confused here, I really need your help so that you could help me get my applications working back to normal and get rid of that damn Nimda Dropper thingy.
I tried going through the ‘repair’ process with windows’ ‘add & remove software’ tool, but it didn’t change a thing for my avast problem.
Thanks in advance, I’m miserable here.
My system is a Windows XP SP2, fully updated with Microsoft/Windows Update
on P4 3.8GHZ, 2GB RAM
My firewall is Windows’ XP standard firewall
and I suspect the infection came from a friend’s FTP server on my university’s LAN as it happened after I downloaded photos from his server and rebooted. (didn’t view the photos or anything… except one I wanted to look at remotely using windows’ file explorer and that the FTP shell opened in explorer… could it be his ftp server is infected by Nimda and I was infected through the javascript flaw by viewing this picture ? seems unlilely to me, picture wasn’t even in a webpage, just a plain picture).
thanks.
