Computing.Net > Forums > Security and Virus > W32.Nimda.enc Can it be stopped?

Computer Problems? Computing.Net has over 1,000,000 posts about all things technology related! Over 90% answered within 24 hours! Click here to start participating now! Also, be sure to check out the New User Guide.

W32.Nimda.enc Can it be stopped?

Reply to Message Icon

Name: Michelle
Date: March 8, 2003 at 13:22:59 Pacific
OS: Windows XP
CPU/Ram: 1.7/512
Comment:

I've read many posts on this and was wondering if anyone has found out how to get rid of W32.Nimda.enc. It's very annoying and seems to not go away no matter what I try. My windows explorer has been corrupted and internet explorer.



Sponsored Link
Ads by Google

Response Number 1
Name: michael2
Date: March 8, 2003 at 14:43:59 Pacific
Reply:

Does this help...

http://securityresponse.symantec.com/avcenter/venc/data/w32.nimda.a@mm.removal.tool.html


0

Response Number 2
Name: Tom41
Date: March 8, 2003 at 16:39:50 Pacific
Reply:

From Symantec:


What is an .enc detection?

Last Updated on: February 7, 2003 03:43:07 PM PST

In some cases, Norton AntiVirus detects a threat and adds the extension ".enc" to the name of the detection. For example, if a computer has received email infected with W32.Nimda.A@mm, you may also see a detection for W32.Nimda.enc.

The .enc detection is actually a detection of header information or encoded script which can be contained in an email message. The detection of an encoded script is the result of the script using a vulnerability that affects some versions of Microsoft Internet Explorer, and therefore Microsoft Outlook and Outlook Express. This vulnerability, if not patched with a Microsoft program update, allows a virus, worm, or Trojan to be executed just by reading or previewing the email message. Information on this problem, which is known as a MIME header exploit, can be found at:

http://www.microsoft.com/technet/security/bulletin/MS01-020.asp


How it works
The following is a typical--but not the only--scenario:

1. You receive an email message that has an infected attachment. You have current virus definitions, and the preview function in Microsoft Outlook or Outlook Express is enabled.
2. Depending on your version of Norton AntiVirus (NAV) and your program settings, NAV detects the infected attachment either after it is downloaded or when the attachment is executed. (If you are using an unpatched version of Internet Explorer, it could be executed without your knowledge.)
3. NAV detects the infected attachment and deletes or quarantines it. The message, which still contains the (non-infectious) header information, is not deleted.
4. Each time that you select the previously infected message in your email program, NAV detects the header as .enc.

How to fix the problem
1. Make sure that you have updated your version of Internet Explorer, or that you are using a version that includes the update. For additional information, go to the Microsoft Web page:

http://www.microsoft.com/technet/security/bulletin/MS01-020.asp

2. Note which message is causing the alert.
3. Turn off the preview function in Microsoft Outlook or Outlook Express:

NOTE: The following is provide for your convenience. The steps may vary, depending on your version. For additional information, read the product document or online help.

1. Click "Ignore the problem and continue with the infected file."
2. Do one of the following:
In Microsoft Outlook, click the View menu, and then make sure that the Preview Pane menu item is not selected.
In Outlook Express, click the View menu, and then click Layout. Uncheck Show Preview Pane.
3. Open the Inbox, right-click the infected email, and then click Delete.
4. Right-click the "Deleted Items" folder, and then click "Empty Deleted Folder."
5. Turn on the preview pane option, if desired.



0

Sponsored Link
Ads by Google
Reply to Message Icon

Related Posts

See More


Messenger login scroll ba... Wireless Network Secuirty



Post Locked

This post is quite old and has been locked from receiving new replies. Please create a new posting instead.


Go to Security and Virus Forum Home


Sponsored links

Ads by Google


Results for: W32.Nimda.enc Can it be stopped?

w32.nimda.enc can`t be removed www.computing.net/answers/security/w32nimdaenc-cant-be-removed/3401.html

W32.Nimda.enc www.computing.net/answers/security/w32nimdaenc-/1706.html

w32.nimda.enc... www.computing.net/answers/security/w32nimdaenc/778.html