Microsoft KB Archive/313871

= The Nimda Virus May Cause Your Computer to Stop Working =

Article ID: 313871

Article Last Modified on 2/15/2002

-

APPLIES TO


 * Microsoft Windows XP Home Edition
 * Microsoft Windows XP Professional Edition

-



This article was previously published under Q313871



SYMPTOMS
You may receive the following error message:

Explorer.exe has encountered a problem and needs to close. We are sorry for the inconvenience.

If you view the data the error report contains, the following error signature information is displayed:

App name     App version  Module name  Module version  Offset

Explorer.exe 6.0.2600.0   Ntdll.dll    5.1.2600.0      0003c520



CAUSE
This issue may occur if your computer is infected by any variant of the Nimda virus. These variants include (but are not limited to):

W32.Nimda.A

W32.Nimda.E



RESOLUTION
Microsoft does not provide software that can detect or remove computer viruses. If you suspect or confirm that your computer is infected with a virus, obtain current antivirus software. For a list of antivirus software manufacturers, click the following article number to see the article in the Microsoft Knowledge Base:

49500 List of Antivirus Software Vendors



MORE INFORMATION
If your computer has this virus, there is probably an Admin.dll file in the root folder of drive C (except with the latest variant of the virus). If your computer has the latest variant of the Nimda virus (currently W32.Nimda.E):
 * The received attachment is changed to Sample.exe.
 * The Httpodbc.dll file is &quot;dropped&quot; on your computer.
 * The virus copies itself to the Windows folder as Csrss.exe instead of Mmc.exe

Keywords: kbprb kbprod2web KB313871

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.