From: Terry Halligan Newsgroups: comp.bugs.misc Subject: W.32 Nimda.A@mm virus Date: Sun, 14 Apr 2002 15:10:23 +0100 Message-ID: NNTP-Posting-Host: tagh.demon.co.uk X-NNTP-Posting-Host: tagh.demon.co.uk:158.152.48.225 X-Trace: news.demon.co.uk 1018793560 nnrp-12:5530 NO-IDENT tagh.demon.co.uk:158.152.48.225 X-Complaints-To: abuse@demon.net MIME-Version: 1.0 X-Newsreader: Turnpike Integrated Version 5.01 U Lines: 24 I seem to have acquired this worm. I was first aware of it when I found I was getting an error message when I tried to open Word 2000. I was repeatedly told I was out of memory and then got "Internal error 2889." I went onto the Norton website and downloaded a removal tool which I opened to remove the worm manifestation. However, the notes warn that my operating system, Windows ME has a file Riched20.dll which I need to locate and remove or rename and then reinstall from my Windows ME CD- ROM. I've updated my Explorer to v6 which includes some security not in the earlier version I used. The Symantec notes on removal of the corrupt Riched20.dll file give an example of the command to be used in Dos if Windows 98 were used: extract /a d:\win98\win98_28.cab riched20.dll /\\\\l c:\windows\system However, although alternative command are given for Windows 95,NT and 2000, Windows ME alternative command details are not given and I'm not sure what to do. Does anyone have any experience of this problem? -- Terry Halligan