Beware of W32.Nimda.A@mm worm!

[ayoub_ibrahim]

Affected Software Versions
Microsoft IIS 4.0
Microsoft IIS 5.0

this is what Symantec has to say about it.

W32.Nimda.A@mm is a new mass-mailing worm that utilizes multiple methods to spread itself. The worm sends itself out by email, searches for open network shares, and attempts to copy itself to unpatched Microsoft IIS web servers. The worm does this using the Unicode Web Traversal exploit. A patch and information regarding this exploit can be found at http://www.microsoft.com/technet/sec...n/ms00-078.asp

Users visiting compromised Web servers will be prompted to download an .eml (Outlook Express) email file, which contains the worm as an attachment. Name of attachment: README.EXE (This file will NOT be visible as an attachment in the email received)


Also, the worm will create an open network share on the infected computer, allowing access to the system.
full description at http://www.symantec.com/avcenter/ven...imda.a@mm.html

---------
edited to correct the first url posted

[Jammrock]

My all outgoing and incoming HTTP traffic was shut down at my office today. No Internet really sucks when there's nothing to do.

Jammrock

[dZeus]

I got a mail and newsgroup file, both for outlook express, uploaded into my writable upload share already today.. I guess the virus is spreading fast

[Paulr]

Well it's now 11:00am.
For the past 2 and 1/2 hours I've been working on the problem.

All my IIS Web servers are patched and clean.
All of my workstations are now running the latest Symantec Anti Virus Definitions.
All of my workstations are now running fully patched versions of IE, be it 5.01, 5.5 or 6.0.

I've now opened up all our HTTP traffic again at the router, we are back in business!
150 minutes to sort all the problems, a pain sure, but we're all sorted now!

[The PIT]

It's great when local administrators don't keep updated records of who's running the machines infected. At least those buggers have to do all the running around the building to find the machine.

[breezer]

I'm so glad i'm using apache & nes as web servers!

breezer

[Gurm]

1. Keep your servers up to date.

2. Don't open executable file attachments.

In fact, what everyone overlooks is that by default the newer versions of MS mail programs (OE 6.0, OXP) don't even let executables through, much less "automatically display them".

How hard is it not to get one of these viruses? Not hard.

- Gurm

[dZeus]

indeed.. no knowledgeble person would open those files... but what if an average jack who uses a computer finds such an email file? He probably would think: "hmm... how did one of my emails end up here.... let's see what it was all about, so I can put it somewhere else"

[EdSki]

I know...
I was at a training center totday, and all the student pc's where infected...all of them! They all had unpatched, out of the box win2k on them (not a smart thing to do). Don't know about their regular network, but i have my suspisions..

This is a tricky one..it infected random exe files and tried load them. Put stuff in the Run registry key. Dumped infected readme.eml files in the netlogon. Enabled the quest account and put it in the admin groups..opend up c$ for everyone..etc..etc..

Grtz,
Ed

[Technoid]

This is Why I never in my life would use OE....

[Taz]

Originally posted by Technoid
This is Why I never in my life would use OE....

One of our customers got it last night and they use Novell Groupwise instead of Outlook so even non OE users are at risk.

[Admiral]

I just downloaded the latest Norton Antivirus definition update and thought I'd just scan my PC.
The file infected was a gif in the IE Temp folder.
What does that mean, that I got it while browsing ?

[ayoub_ibrahim]

What does that mean, that I got it while browsing ?

This worm is dangerously different than virtually all other e-mail and network-borne viruses: It can infect a computer when a user simply clicks on the subject line of an e-mail in an attempt to open it, or visits a Web page housed on an infected server.

[Gurm]

Ayoub,

But... see... if you have half a brain... you have the security turned up on your e-mail proggy.

In Outlook, NOTHING IS RUN AUTOMATICALLY any more.

Nothing.

Nada.

Zip.

Zilch.

Zero.

Bupkuss.

And you can force any GOOD e-mail program to act the same way. In fact, in the newest Outlook (XP and 2k-sr1) you have to do a registry edit just to SEE the executable, instead of a cutesy "no executables allowed, so this message purges" notice.

Notice I said "good", which excludes Outlook Express, anything from Lotus, and anything from Novell... and pretty much narrows it down to Outlook and Eudora (and a few other things, yeah yeah... nobody rip my head off for forgetting your favorite mail proggy).

- Gurm