W32:nimda

Avast Free Antivirus / Premium Security
1

Hi
Avast scanner have detected virus or Worm call W32:nimda. There is different action that can be taken: suppress, put in quarantain, etc. When we «suppress», does that mean that all possible infected files are free from that virus. Is there other action that we have to do?

Thanks

2

When you click suppress, only the specific file (or worm) is deleted. Not all, but the only that is shown in the message box.
The best action to take, with sure, is ‘Send the file to Chest’, where you’re be safe from further infection and could ‘handle’ (move, delete, clean, etc.) that file inside of the avast! program.

Wellcome to forums 8)

3

Thanks for the quick answer
I have already delete. So how can I send the file to chest. I see an inscription in the log journal, warning: « sign of Win32 nimda has been found in «D:\1386\APPS\App25667.exe\hp\tmp\nav2002\support \EDISK\DISKi.IMG» file

4

This file is better to delete ;D
To send files to Chest just click the button ‘Move to Chest’ in the virus warning message :wink:

5
D:\1386\APPS\App25667.exe\hp\tmp\nav2002\support \EDISK\DISKi.IMG
D:\1386\APPS\App25667.exe\hp\tmp\nav2002\support \EDISK\

Very suspicious folder, I think it is better to delete the entire folder.
App25667.exe is definatly not a trusted folder name :wink:

6

Hi
After reading your replys, I maded another scan and again there were a message off infected file, the same as yesterday. So I tried to send file to chest (Mise en quarantaine in french) but I received a message «Access refused» …!. So I tried action «rename/move» the file have been rename «DISK1.IMG.vir » and move in
C:/program files/alwill/Avast4/DATA/moved/DISK1.IMG.vir .
I made a third scan of D:/ drive (location of the «potentiel» worm). I received the same warning off infected files .
When I look in the log viewer I got that message:
«D:\1386\APPS\App25667.exe\hp\tmp\nav2002\support \EDISK\DISKi.IMG» fil. The following error occured during the move/rename off the file. Refused access»

So is there something wrong happen…is it better to delete the file from «Chest/User file/ DISK1.IMG.vir

Yesterday I scan with «Avast virus cleaner» and no virus have being detected.

So I am wondering if it is a real issue…?
Thanks for your help

7

I suggest you run a boottime scan and delete all infected files.

Also have a look at the page in my signature to see how to clean a system from malware.

8

What is boottime scan? My english is limited…

9

From Avast’s manual/help

Scheduling the Boot Time Scan

Click on the Menu button.
Choose Schedule Boot Time Scan.
Doing so displays a dialog allowing you to schedule virus scanning.
Check Archives, if you want scan all the archives.
Specify whether all the disks or just a specific folder should be scanned.
Select Advanced options for scheduling details.
Select how to automatically process infected files.
Choose how to automatically process infected system files.
Click the Schedule button to confirm the settings.