Nimda (computer worm)

From Wikipedia, the free encyclopedia

This article does not cite any references or sources. (December 2007)
Please help improve this article by adding citations to reliable sources. Unverifiable material may be challenged and removed.

Computer security Portal

Nimda is a computer worm, isolated in September 2001. It is also a file infector. It quickly spread, eclipsing the economic damage caused by past outbreaks such as Code Red. Multiple propagation vectors allowed Nimda to become the Internet’s most widespread virus/worm within 22 minutes. Due to the release date, some media quickly began speculating a link between the virus and Al Qaeda, though this relationship ended up being untrue.

Nimda affected both user workstations (clients) running Windows 95, 98, Me, NT, or 2000 and servers running Windows NT and 2000.

The worm's name spelled backwards is "admin".

The author of Nimda remains unknown.

[edit] Methods of infection

Nimda was so effective partially because it—unlike other famous malware like the Morris worm or Code Red—uses five different infection vectors:

via email
via open network shares
via browsing of compromised web sites
exploitation of various Microsoft IIS 4.0 / 5.0 directory traversal vulnerabilities. (Both Code Red, and Nimda were hugely successful exploiting well known and long solved vulnerabilities in the Microsoft IIS server.[1])
via back doors left behind by the "Code Red II" and "sadmind/IIS" worms.