How to Eradicate Nimda Worm from Win 95/98

From: Luis Rivera <lrivera@IT.FIT.EDU>
Subject: Removing the W32.Nimda.A@mm from Windows 95/98
To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM

Hello Russ,

I am not sure if anyone has posted this info yet but we were able to
figure out how to remove the W32.Nimda.A@mm from Windows 95/98. So far
it has been effective,

1) boot in DOS mode
2) edit system.ini file in c:\windows
3) look for this line
shell= explorer.exe load.exe -donotloadold

replace it with

shell=explorer.exe

4) goto c:\windows\system
1) run attrib -s -h riched20.dll
2) run attrib -s -h load.exe
3) del riched20.dll, 56kb (check the date on it, if todays date
delete it)
4) del load.exe

If anyone has gotten further with win2k would appreciate the info.

- Luis Rivera
Florida Tech

---