# MA-034.092001: MyCERT Advisory - NIMDA Worm

**Date:** 19 Sep 2001  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-034.092001  
**Advisory ID:** MA-034.092001

---

1.0 Description
#### 1.1 Overview
This worm was found on September 18th, 2001, Eastern Standard Time (EST). Nimda is a complex virus with a mass mailing worm component which spreads itself in attachments named README.EXE.
Nimda is the first worm to modify existing web sites to start offering infected files for download. Also it is the first worm to use normal end user machines to scan for vulnerable web sites. This technique enables Nimda to easily reach intranet web sites located behind firewalls - something worms such as Code Red couldn't directly do. Nimda uses the Unicode exploit to infect IIS web servers.
This new worm appears to spread by multiple mechanisms:
- from client to client via email
- from client to client via open network shares
- from web server to client via browsing of compromised web sites
- from client to web server via active scanning for and exploitation of the "Microsoft IIS 4.0 / 5.0 directory traversal" vulnerability
- from client to web server via scanning for the back doors left behind by the "Code Red II" and "sadmind/IIS" worms
#### 1.2 Systems Affected
If affects workstations running Windows 95, Windows 98, Windows Me and web servers running Windows NT 4 IIS 4.0 and Windows 2000 IIS 5.0.
#### 1.3 Aliases
The worm is also known as:
W32/Nimda worm
Concept Virus (CV) v.5.
NIMDA.A
#### 1.4 Payload
Infected client machines attempt to send copies of the Nimda worm via email to all addresses found in the Windows address book.
Likewise, the client machines begin scanning for vulnerable IIS servers. Nimda looks for backdoors left by previous IIS worms: [Code Red II](/en/services/advisories/mycert/2001/main/detail/119/index.html) and sadmind/IIS worm [CA-2001-11] http://www.cert.org/advisories/CA-2001-11.html. It also attempts to exploit the [IIS Directory Traversal vulnerability](/en/services/advisories/mycert/2001/main/detail/127/index.html).
The infected client machine transfers a copy of the Nimda code to any server that it scans and finds to be vulnerable. Once running on the server machine, the worm traverses each directory in the system (including all those accessible through a file shares) and write a copy of itself to disk using the name "README.EML". When a directory containing web content (e.g., HTML or ASP files) is found, the following snippet of Javascript code is appended to every one of these web-
This modification of web content allows further propagation of the worm to new clients through a browser or browsing of a network file system.
### 2.0 Technical Matters
(as extracted from CERT Advisory CA-2001-26 - http://www.cert.org/advisories/CA-2001-26.html)
The Nimda worm has the potential to affect both user workstations (clients) running Windows 95, 98, ME, NT, or 2000 and servers running Windows NT and 2000.
#### 2.1 Email Propagation
This worm propagates through email arriving as a MIME type "audio/x-wav", but it contains a base64-encoded attachment named "readme.exe", which is a binary executable. Due to a vulnerability described in CA-2001-06 http://www.cert.org/advisories/CA-2001-06.html (Automatic Execution of Embedded MIME Types), most mail software automatically runs the enclosed attachment and, as result, infects the machine with the worm.
Infected client machines attempt to send copies of the Nimda worm via email to all addresses found in the Windows address book. The email message delivering the Nimda worm appears to also have the following characteristics:
- The text in the subject line of the mail message appears to be variable, but those seen to date have been over 80 characters long.
- There appear to be many slight variations in the attach binary file, causing the MD5 checksum to be different when one compares different attachments from different email messages. However, the file length of the attachment appears to consistently be 57344 bytes.
#### 2.2 Port Propagation
Likewise, the client machines begin scanning for vulnerable IIS servers. Nimda looks for backdoors left by previous IIS worms: [Code Red II](/en/services/advisories/mycert/2001/main/detail/119/index.html) and sadmind/IIS worm [CA-2001-11] http://www.cert.org/advisories/CA-2001-11.html. It also attempts to exploit the [IIS Directory Traversal vulnerability](/en/services/advisories/mycert/2001/main/detail/127/index.html). The selection of potential target IP addresses follows these rough probabilities:
- 50% of the time, an address with the same first two octets will be chosen
- 25% of the time, an address with the same first octet will be chosen
- 25% of the time, a random address will be chosen
The infected client machine transfers a copy of the Nimda code to any server that it scans and finds to be vulnerable. Once running on the server machine, the worm traverses each directory in the system (including all those accessible through a file shares) and write a copy of itself to disk using the name "README.EML". When a directory containing web content (e.g., HTML or ASP files) is found, the following snippet of Javascript code is appended to every one of these web-
This modification of web content allows further propagation of the worm to new clients through a browser or browsing of a network file system.
#### 2.3 Browser Propagation
As part of the infection process, the Nimda worm modifies all web content files it finds (including, but not limited to, files with .htm, .html, and .asp extensions). As a result, any user browsing web content on the system, whether via the file system or via a web server, may download a copy of the worm. Some browsers may automatically execute the downloaded copy, thereby infecting the browsing system.
#### 2.4 File System Propagation
The Nimda worm creates numerous copies of itself (using the name README.EML) in all writable directories (including those found on a network share) to which the user has access. If a user on another system subsequently selects the copy of the worm file on the shared network drive in Windows Explorer with the preview option enabled, the worm may be able to compromise that system.
#### 2.5 System FootPrint
The scanning activity of the Nimda worm produces the following log entries for any web server listing on port 80/tcp:
- GET /scripts/root.exe?/c+dir
GET /MSADC/root.exe?/c+dir
GET /c/winnt/system32/cmd.exe?/c+dir
GET /d/winnt/system32/cmd.exe?/c+dir
GET /scripts/..%5c../winnt/system32/cmd.exe?/c+dir
GET /\_vti\_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe?/c+dir
GET /\_mem\_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe?/c+dir
GET /msadc/..%5c../..%5c../..%5c/..\xc1\x1c../..\xc1\x1c../..\xc1\x1c../winnt/ system32/cmd.exe?/c+dir
GET /scripts/..\xc1\x1c../winnt/system32/cmd.exe?/c+dir
GET /scripts/..\xc0/../winnt/system32/cmd.exe?/c+dir
GET /scripts/..\xc0\xaf../winnt/system32/cmd.exe?/c+dir
GET /scripts/..\xc1\x9c../winnt/system32/cmd.exe?/c+dir
GET /scripts/..%35c../winnt/system32/cmd.exe?/c+dir
GET /scripts/..%35c../winnt/system32/cmd.exe?/c+dir
GET /scripts/..%5c../winnt/system32/cmd.exe?/c+dir
GET /scripts/..%2f../winnt/system32/cmd.exe?/c+dir
Note: The first four entries in these sample logs denote attempts to connect to the backdoor left by Code Red II, while the remaining log entries are examples of exploit attempts for the Directory Traversal vulnerability.
### 3.0 Possible Steps
**3.1 Prevention**
There are a few steps that users can take to prevent and defend against the infection. These measures apply to web servers, workstations and networks.
1. Scan your server if it is vulnerable to Nimda worm.
Download the retina Nimda Scanner (version 1.0 Beta):
http://www.eeye.com/html/Research/Tools/RetinaNimda.exe
2. Protect/defend your network against the nimda virus.
Refer to:
http://www.cisco.com/warp/public/63/nimda.shtml
3. All IE versions should have applied the relevant patch.
The patch is available at:
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS01-020.asp
4. Disable Active Scripting in IE by following the steps below:
\*Internet Explorer 5.X
1. Open Internet Explorer.
2. Select Internet Options from the Tools menu.
3. In Internet Options dialog box select the Security tab.
4. Click Custom level button at bottom right. The Security settings dialog box will pop up.
5. Under Scripting category check Active Scripting, Allow paste options via script and Scripting of Java applets
6. Check radio boxes.
7. Click OK twice to close out.
\*Internet Explorer 4.0
1. Select Internet Options from the View menu
2. Click the Secutity tab
3. Click Custom
4. Click Settings
5. Scroll down to locate Scripting
6. Click Enable for Active Scripting
7. Click OK, then click the Reload button
5. Apply relevant patch for web servers running IIS.
The patch is available at:
http://www.microsoft.com/technet/security/bulletin/MS01-044.asp
6. Use the CALCS program to modify the permissions on TFTP.EXE to remove all use;
CALCS %systemroot%/system32/tftp.exe /D Everyone
CALCS %systemroot%/system32/tftp.exe /D System
Do the same for CMD.EXE (note, this could be tried with THUMBVM.DLL as well, haven't tried this myself yet)
7. Ensure that TFTP is not permitted out through your network gateway (note that newly infected machines may try and TFTP \*internally\* from some other infected machine you have on your network)
8. Modify or remove;
- HKEY\_CLASSES\_ROOT\.eml
HKEY\_CLASSES\_ROOT\.nws
9. Disable all your shared drives or limit the shares to give only READ access to all users since this worm may perpetually infiltrate your system through the shared drives.
10. Do not open any suspicious/unknown attachments and delete them immediately. Regularly update the virus definition file of your antivirus software and run a virus scan on the computer. This is to ensure that the software is able to detect the presence of a new virus.
11. Always run a virus scan on any downloadable files before executing it. It is advisable that your antivirus software is running in "Auto Protect Mode" at all time.
Refer to Safe Email Practices:
[https://www.mycert.org.my/portal/articles-content?menu=4b05e0fb-afa1-408f-90ca-ea0edf4aca8b&id=96fa0022-2ca9-47cb-975f-0d1225cc278e](https://www.mycert.org.my/portal/articles-content?menu=4b05e0fb-afa1-408f-90ca-ea0edf4aca8b&id=96fa0022-2ca9-47cb-975f-0d1225cc278e
)
**3.2 Detection**
There are three ways to remove this worm, the automatic removal, the manual removal or reformatting the system drive.
- 3.3.1 Automatic Removal
Download a fixtool provided by Trend Micro to remove this worm automatically. This tool will clean a Windows system infected by NIMDA worm without having to boot with a boot disk or emergency rescue disk (ERD).
The fix tool is available at:
http://www.antivirus.com/vinfo/security/nimda\_form/
Another fixtool provided by Symantec to remove this worm automatically.
The fix tool is available at:
http://www.symantec.com/avcenter/venc/data/[[email protected]](/cdn-cgi/l/email-protection)
3.3.2 Manual Removal
For manual removal, pls follow steps provided by Trend Micro at:
http://www.antivirus.com/vinfo/virusencyclo/default5.asp?VName=PE\_NIMDA.A
3.3.3 Reformat the system drive
Another way to recover is to format the system drive(s) and reinstall the system software from trusted media (such as vendor-supplied CD-ROM). Make sure the system is disconnected from the network.
3.3.4 Next, apply the appropriate patch if your machine is not patched.
For IIS web servers. A cumulative patch which addresses all of the IIS-
http://www.microsoft.com/technet/security/bulletin/MS01-044.asp
For workstations:
Apply IE 5x Service Pack 2 which is available at:
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS01-020.asp
### 4.0 More Information
More information on this virus can be obtained from the following sites:
http://www.datafellows.com/v-descs/nimda.shtml
http://www.sarc.com/avcenter/venc/data/[[email protected]](/cdn-cgi/l/email-protection)
http://www.cert.org/advisories/CA-2001-26.html
http://www.antivirus.com/vinfo/virusencyclo/default5.asp?VName=PE\_NIMDA.A