From: Terry Halligan <terry@tagh.demon.co.uk>
Newsgroups: comp.bugs.misc
Subject: W.32 Nimda.A@mm virus
Date: Sun, 14 Apr 2002 15:10:23 +0100
Message-ID: <gZTJxNAP3Yu8IwFY@tagh.demon.co.uk>
NNTP-Posting-Host: tagh.demon.co.uk
X-NNTP-Posting-Host: tagh.demon.co.uk:158.152.48.225
X-Trace: news.demon.co.uk 1018793560 nnrp-12:5530 NO-IDENT tagh.demon.co.uk:158.152.48.225
X-Complaints-To: abuse@demon.net
MIME-Version: 1.0
X-Newsreader: Turnpike Integrated Version 5.01 U <bYCKnqKtVctg7WdC6byXEvI+A6>
Lines: 24


I seem to have acquired this worm. I was first aware of it when I found
I was getting an error message when I tried to open Word 2000. I was
repeatedly told I was out of memory and then got "Internal error 2889."
I went onto the Norton website and downloaded a removal tool which I
opened to remove the worm manifestation.  However, the notes warn that
my operating system, Windows ME has a file Riched20.dll which I need to
locate and remove or rename and then reinstall from my Windows ME CD-
ROM.
I've updated my Explorer to v6 which includes some security not in the
earlier version I used.

 The Symantec notes on removal of the corrupt Riched20.dll file give an
example of the command to be used in Dos if Windows 98 were used:

extract /a  d:\win98\win98_28.cab riched20.dll /\\\\l c:\windows\system

However, although alternative command are given for Windows 95,NT and
2000, Windows ME alternative command details are not given and I'm not
sure what to do. 

 Does anyone have any experience of this problem? 
     
-- 
Terry Halligan

