Virus Wars – Return of the Nimda

Computer security experts at SecurityFocus have warned that the Nimda virus, which caused havoc among Microsoft IIS, Internet Explorer and Outlook Express users earlier this month, contains

Computer security experts at SecurityFocus have warned that the Nimda virus, which caused havoc among Microsoft IIS, Internet Explorer and Outlook Express users earlier this month, contains segments of code that will re-activate dormant parts of the virus ten days after the date of initial infection.

Nimda, which uses a combination of MIME holes, IIS exploits and open network shares to propagate, will re-activate portions of its code that send copies of itself via email.

SecurityFocus believes that, despite the potential of Nimda to infect new hosts via the reawakening email component of its code, overall numbers of newly infected computers will be low. This is due solely to other aspects of Nimda (namely, IIS exploitation and use of open network shares) remaining active during the preceding 10 days, giving network admins' ample time to clean and secure infected systems.

This is fine in theory. However, past experience tells us that there will almost certainly be a fair number of IIS server admins' and MS IE users who have yet to patch their servers, or install the latest anti-virus DAT files. Thus, more computers will fall victim to Nimda in the coming days. *Sigh*.