Is there a new flavor of nimda roaming out there ? [W32.Nimda.enc(dr)]

[Admiral]

It's infecting ikernel.exe and lucky me got it.
Nav 2002 can't remove it (with the pattern file from november 11th) so I had to delete the file.
Is ikernel.exe part of the Demo Shield ?
I seem to have got it after installing programs using the new Demo Shield 7 (installation shield).

[isochar]

I got the virus and had NAV2k2 quarantine it, then deleted the file. I'm not sure where it came from...

[ayoub_ibrahim]

http://www.symantec.com/avcenter/ven...imda.e@mm.html is the closest I've seen!

[Admiral]

I got it after installing the Myth 3 multiplayer demo, which is using Demo Shield 7 to install.
It was in Program Files/CommonFiles/InstallShield/Engine...

I also had it quarantined and deleted, but my XP installation is booting slower now and the NAV autoprotection is disabled for a few seconds when it boots into windows (maybe just as long for nimda to insert into the XP kernel ? ntoskrnl.exe is not infected though) .I also have a new prog added to my startup, something called "kernel fault check" (I'm in 98 now so I don't have the exact name). Guess it's put there by Windows... if I remove the line Windows keeps rewritting it.

[The PIT]

Well theres another virus defination update file the third in three days so it maybe worth while you doing another update and see what it says then.

[Admiral]

The virus definition dated 11/11/01 (updated via LiveUpdate), which can also be downloaded here, could not remove it. This was the virus definition I had installed when I detected it.
There doesn't seem to be a newer (than nov 11) virus definition yet.
My system seems to be clean now (since I deleted the infected file), still, I'm thinking of formating and reinstalling Windows.

[The PIT]

looks like live update is a bit behind times. Yep you're right the one I downloaded today is dated 11/11/01 and I downloaded an update the day before and the day before that. No doubt they'll be another one on the way.

[Admiral]

There is one from November 12th now...

I don't get it, I boot in XP, make the NAV update, reinstall the infected demo, now it can't even detect it.

I boot in 98, reinstall the infected demo, NAV starts screaming (with the virus definition from 11/11/01). I tell it to leave the file alone, go make the update... now it can't detect it either.

Now, why would Symantec give us a new virus definition that stops detecting it ?
Or there wasn't really a worm to begin with, just some new thing in Demo Shield 7 that NAV thought to be nimda ?

[Fat Tone]

Latest NAV definitions are now 12/11/01 (12th dec).

[Greebe]

Admiral is correct, November the 12th Tony... unless you're traveling forward in time

[ayoub_ibrahim]

Originally posted by Greebe
Admiral is correct, November the 12th Tony... unless you're traveling forward in time

LOL

[Paulr]

Tony,
You have to remember that the US peeps for some reason known only to them put their dates:
month/day/year

Where as we blighty people use:
day/month/year

No idea why, but it can get confusing when your trying to check driver release dates on web sites.

[Liquid Snake]

From InstallShield Site

Dear InstallShield Customer,
As you may be aware, recent virus definition updates provided by Symantec for the Norton Anti-Virus software are incorrectly identifying the InstallShield Professional 6.31 script engine (ikernel.exe) as being infected by the W32.Nimda.enc (dr) virus. This is a false positive. Symantec/Norton has already updated the virus definition. For complete details, please read <A HREF="http://support.installshield.com/kb/view.asp?pcode=ALL&articleid=Q105740">Knowledge Base Article #Q105740.</A>

InstallShield remains dedicated to delivering the highest quality software. We regret any inconvenience this may have caused.

[Admiral]

Thanks for clearing it up LS