The Nimda Virus May Cause Your Computer to Stop Working (313871)

The information in this article applies to:

Microsoft Windows XP Home Edition
Microsoft Windows XP Professional

This article was previously published under Q313871

SYMPTOMS

You may receive the following error message:

Explorer.exe has encountered a problem and needs to close. We are sorry for the inconvenience.

If you view the data the error report contains, the following error signature information is displayed:

App name      App version  Module name  Module version  Offset
----------------------------------------------------------------
Explorer.exe  6.0.2600.0   Ntdll.dll    5.1.2600.0      0003c520

CAUSE

This issue may occur if your computer is infected by any variant of the Nimda virus. These variants include (but are not limited to):

W32.Nimda.A
W32.Nimda.E

RESOLUTION

Microsoft does not provide software that can detect or remove computer viruses. If you suspect or confirm that your computer is infected with a virus, obtain current antivirus software. For a list of antivirus software manufacturers, click the following article number to see the article in the Microsoft Knowledge Base:

49500 List of Antivirus Software Vendors

MORE INFORMATION

If your computer has this virus, there is probably an Admin.dll file in the root folder of drive C (except with the latest variant of the virus). If your computer has the latest variant of the Nimda virus (currently W32.Nimda.E):

The received attachment is changed to Sample.exe.
The Httpodbc.dll file is "dropped" on your computer.
The virus copies itself to the Windows folder as Csrss.exe instead of Mmc.exe

Modification Type:	Major	Last Reviewed:	2/15/2002
Keywords:	kbprb kbProd2Web KB313871