Hos
www.trendmicro.com fandt jeg under PE_NIMDA.A dette.
********************************************************
Manual Removal Instructions
Disconnect system from the network.
Click Start>Run, type SYSTEM.INI then hit Enter.
Look for the "Shell =" line and modify as follows:
From:
Shell = explorer.exe load.exe –dontrunold
To:
Shell = explorer.exe
Save and then close SYSTEM.INI.
Click Start>Run, type WININIT.INI then hit the Enter key.
Look for and then delete the lines that contain the following text string:
mepXXXXX.tmp.exe
Save and close WININIT.INI file.
Scan your system with Trend Micro antivirus and clean all files detected as PE_NIMDA.A. To do this Trend Micro customers must download the latest pattern file and scan their system. Other email users may use HouseCall, Trend Micro's free online virus scanner. Some files may be corrupted or contain only a pure strain of the worm and are detected as PE_NIMDA.A-O. Delete these files.
Restart your system and repeat step 8.
Restore the RICHED20.DLL file by performing any of the following:
Note:Change the <%drive%> entry with the drive letter of your CD-ROM drive.
Using Windows 98 SE installation CD, click Start>Run. On the window that pops out, type:
extract /a <%drive%>:\win98\setup\win98_37.cab riched20.dll /L c:\windows\system
Using Windows ME installation CD, click Start>Run. On the window that pops out, type:
extract /a :\win9x\win_14.cab riched20.dll /L c:\windows\system
Using Office 2000 Premium Edition, click Start>Run. On the window that pops out, type:
extract /a <%drive%>:\office1.cab riched20.dll /L c:\windows\system
Make sure you have installed the latest patches available:
Update to Internet Explorer 5.01 SP2
Update to IE 5.5 SP2
Update to IE 6.0
If any of the above is not possible, download the below patches. Before you do, please read Microsoft’s Security Update page:
Service Pack (6a) for NT 4 users.
Security Fix Rollup Package
IIS-related Security Patch
********************************************************
I SYSTEM.INI fandtes ikke "shell="
vedrørende WININIT.INI kom en meddelse Could´nt find the file.
Så reelt har jeg kun slettet de filer der havde virus og vil nu igen (suk) scanne for virus
/René
