Seems like you've just volunteered... :)
The file deletion part is covered by the new AV tools, but not the
Guest account manipulation or registry changes.
This virus does a whole lot of things depending on a lot of factors
(OS, file system, reboot, etc), and I don't think that is been
*thoroughly* reverse engineered.
==============================================================
ASB - http://www.ultratech-llc.com/KB/?File=~MoreInfo.TXT
==============================================================
"I can explain it for you, but I can't understand it for you." --
Unknown
>-----Original Message-----
>From: Mark Fertig [mailto:[EMAIL PROTECTED]]
>Sent: Thursday, September 20, 2001 12:49 AM
>To: NT System Admin Issues
>Subject: Script for cleaning up after Nimda?
>
>
>Has anyone put together a WSH script for deleting all the
>files from Nimda,
>and possibly resetting registry values changed by the worm??
>
>
http://www.sunbelt-software.com/ntsysadmin_list_charter.htm
