|Technical name||Avast: Win32:Nimda|
Kaspersky: Net-Worm.Win32.Nimda or I-Worm.Nimda
|Point of origin||China (alleged)|
|Author(s)||Multiple authors; one serving prison time |
|Operating system(s) affected||Windows 95 – XP|
The first released advisory about this thread (worm) was released on September 18, 2001. Due to the release date, exactly one week after the attacks on the World Trade Center and Pentagon, some media quickly began speculating a link between the virus and Al Qaeda, though this theory ended up proving unfounded.
F-Secure found the text "Concept Virus(CV) V.5, Copyright(C)2001 R.P.China" in the Nimda code, suggesting its country of origin. However, they also noted that a computer in Canada was responsible for an October 11, 2001 release of infected emails alleging to be from Mikko Hyppönen and Data Fellows (F-Secure's previous name).
Methods of infection
- Open network shares
- Browsing of compromised web sites
- Exploitation of various Internet Information Services (IIS) 4.0 / 5.0 directory traversal vulnerabilities. (Both Code Red and Nimda were hugely successful exploiting well known and long solved vulnerabilities in the Microsoft IIS Server.)
- Back doors left behind by the "Code Red II" and "sadmind/IIS" worms.
- "Ten years on from Nimda". TheRegister.com. September 17, 2011. Retrieved October 27, 2020.
- "Information about the Network Worm "Nimda"". Kaspersky Lab. Kaspersky.com. September 18, 2001. Archived from the original on August 7, 2016. Retrieved June 4, 2016.
- "CA-2001-26: Nimda Worm". CERT Coordination Center. Carnegie Mellon University. September 18, 2001. Archived from the original on February 26, 2014.
- "Net-Worm: W32/Nimda Description". F-Secure Labs. F-secure.com. Retrieved June 4, 2016.
- "Kurt Seifried - LASG / Introduction to security". Seifried.org. Retrieved June 4, 2016.
- Chen, Thomas M.; Robert, Jean-Marc. Statistical Methods in Computer Security. 9780429131615.CS1 maint: location (link)