W32.Nimda@A Removal

[TiziteLayinLow]

i have this virus on one of my systems.. the symantec removal tool does not remove it.. it detects it but says cannot remove.. i ran it in safe mode.. theres 2 files it says is infected, i tried to manually delete them and windows doesnt let me, i realized the folders they are in are read-only so i tried to change that and windows gets errors tryin to do that .. im assuming the virus is protecting those files from being deleted...

any help guys?

thanks.
matt enderle

 

[BT7990]

A couple of things you may try:

Download the Stinger from Network Associates to try and fix it.

If there is still an issue, and you have to delete the files manually, you may have try to reset the permissions on them.

 

[nork]

I believe you have to disable system restore and then you are ok to delete the infected file(s)

If system restore has marked the file(s) as part of the system files then system restore wont let you delete it so you have to disable system restore first. Same with goback if you are running goback.

good luck.

 

[TiziteLayinLow]

I will try the stinger, i should have thought of that we use it at work, but as far as system restore points, this is win server 2003 enterprize.. and i dont think it has restore points, i guess they figure if you have a server setup you shouldnt need restore points, just use data backups? but thanks for the advice, ill post the results.

thanks again.

 

[TiziteLayinLow]

I will try the stinger, i should have thought of that we use it at work, but as far as system restore points, this is win server 2003 enterprize.. and i dont think it has restore points, i guess they figure if you have a server setup you shouldnt need restore points, just use data backups? but thanks for the advice, ill post the results.

thanks again.

 

[TiziteLayinLow]

Ya the stinger didnt find anything.. but while it was running my norton auto-protect popped up and found the nimda but it couldnt remove it.. my guess is because the whole folder is read-only and windows doesnt let me change the attributes.

any other suggestions?

 

[BT7990]

Double check to make sure that you are on as Admin or have full admin rights. Then you should be able to delete or reset the file permissions.

 

[TiziteLayinLow]

Ya I have been logging in as Administrator each time, it still does not have access.. I think that maybe the virus is blocking the file delete right or something?

any help is appreciated, matt enderle

 

[Gamingphreek]

Hmm this is weird. If you have to the last resort is to format the ol hard drive. If not what version of norton are you running. If you are running Win 2003 Enterprise it would lead me to beleive that you might be running anti virus corporate edition. If so check for latest definitions and all that good stuff. If not try other virus software and try setting the virtual memory space at zero and deleting it. Virus's cant block deletes tho. If even formatting doesn't work( dunno how that could happen) get software that came with your drive and tell it to write zeroes to your drive.
Good Luck
Kevin

 

[TiziteLayinLow]

well to be honest this server is setup really nice besides this and i dont want to have to format just because of it.. and the error that i get when i try to delete the file is "Access is denied" and says that it could be in use, so maybe the virus has the file open or running in the processes.. I ran stinger in safe mode and that didnt clean anything but now since im running win 2003 enterprize and i did teh windows updates it says i need to activate it.. so thats a whole nother problem them im dealin with.

 

[TiziteLayinLow]

ok well i realized why i couldnt delete the files, my permissions to the folder were set not to let the admin have write rights, so it couldnt delete.. i got it taken care of now, along with teh activation patch.. so im good to go.. but thanks for the help guys.