Welcome to Omgili,
Omgili ( Oh My God I Love It ;) is a search engine for discussions. With Omgili you can find answers and solutions, debates, discussions, personal experiences, opinions and more... To learn more about Omgili click here.
This is a complete preview of the discussion as it was indexed by Omgili crawlers. Use this preview if the original discussion is unavailable.
Click here to view the original discussion.
[http://www.pcabusers.com/forums/showthread.php?t=13...]
Click here to search for discussions with Omgili discussions search engine.
 |
.eml files all over hard drive - PCA Forums
I took a 20 GB hard drive to the computer lab where I work so I could use the nice burners there to back up stuff.
When I get my HD re-installed (just a few minutes ago), it had a .eml file inside EVERY folder on the drive.
I noticed they were named like files on the other drive in that computer.
The attachments had a .txt file and a .exe file inside (which I didn't run, of course).
Is this a virus of some sort?
I am pretty sure I am unaffected, as I didn't run the attached readme.exe, but I am getting a shareware scanner just in case.
|
|
|
Well, the .eml file extension rings a bell , looks like NIMDA (recent high risc internet worm).
More info at:
http://www.symantec.com/avcenter/ven...imda.a@mm.html
and
http://vil.mcafee.com/dispVirus.asp?virus_k=99209&
It also includes infos on how to remove it when your system was infected.
Quote: : When the virus finds an open share, it copies itself to each folder on the drive in .EML format as described later on in this description.
|
|
That is what I thought.
I am clean, though.
The .eml files were easy enough to remove (all 200 of 'em).
I ran F-prot and the symantec anti-nimda tool anyway.
Better safe that sorry.
|
|
Might wanna notify proper people to take care of nimda.
There was a problem at a local LAN with a guy that had it and spread it around.
We took the whole network down and made everyone there run the fix for it (around 40 people there).
Anyways just thought I would say that
|
|
|
Did you also clean out all the shared drives it makes?
|
|
|
You might want to do a search for tftp* (if you're running IIS)
that one .eml file i saw on my desktop was the beginning of one week of zero productivity.
|
|
The Nimda cleaner says I am in good shape.
There are no new shares or accounts.
I never ran the attachment, so I don't think I was infected.
AFAIK, there is no way for a remote computer to execute anything on the local computer, unless they stick a file in your startup and crash your computer somehow.
I forgot that Nimda broke out at work, as it was a couple of weeks ago.
I just got around to plugging the drive in yesterday.
|
|
Just be so kind to notify the people of the network from where you got the virus ...
Cause it seems they're not aware of their infection ...
I forgot to mention it in my first reply
|
|
|
|