Signature Detail

WORM: RICHED20.DLL NIMDA File

This signature detects attempts to create the file RICHED20.DLL on the system, a common sign of the NIMDA worm. The worm can overwrite the original RICHED20.DLL in the Windows systems folder with a binary copy of itself and place additional copies in all folders containing .DOC or .EML files.

Extended Description

Nimda has following payload: large scale e-mailing, replaces and modifies files, degrades system performance, and installs a backdoor.

References

• URL: http://www.f-secure.com/v-descs/nimda.shtml
• URL: http://www.pspl.com/virus_info/worms/nimda.htm
• URL: http://secunia.com/virus_information/7159