|Technical name||Avast: Win32:Nimda
Kaspersky: Net-Worm.Win32.Nimda or I-Worm.Nimda
|Point of Origin||China|
|Operating system(s) affected||Windows 95 – XP|
Nimda is a computer worm, also a file infector. It quickly spread, surpassing the economic damage caused by previous outbreaks such as Code Red. Nimda utilized several types of propagation technique and this caused it to become the Internet’s most widespread virus/worm within 22 minutes.
The worm was released on September 18, 2001. Due to the release date, exactly one week after the attacks on the World Trade Center and Pentagon, some media quickly began speculating a link between the virus and Al Qaeda, though this theory ended up proving unfounded.
The worm's name origin comes from the reversed spelling of it, which is "admin".
F-Secure found the text "Concept Virus(CV) V.5, Copyright(C)2001 R.P.China" in the Nimda code. It contained 3 payloads, fortunately it could not execute all payloads and was unable to reach its maximum potential. First payload left a backdoor for the worm author to access at a later time. Second, it requested a predefined website and installed GT.fbircflood the IRCbot. Last, it moved itself to cylinder 0, head 0, sector 7 to make itself unrecoverable in effort remove and hide the worm aspect. Had the final payload worked, it would have made this an extremely dangerous worm and made detection of it virtually impossible.
Methods of infection
- via email
- via open network shares
- via browsing of compromised web sites
- exploitation of various Microsoft IIS 4.0 / 5.0 directory traversal vulnerabilities. (Both Code Red and Nimda were hugely successful exploiting well known and long solved vulnerabilities in the Microsoft IIS server.)
- via back doors left behind by the "Code Red II" and "sadmind/IIS" worms.
- http://www.cert.org/advisories/CA-2001-26.html CERT first released an advisory on the worm on September 18, 2001