View source for KB 132

===What should I do about the Nimda worm?===
 Article:132
 Created:2001-09-19 00:04:43
 Categories:
   E-mail
   Security

====Question or Symptom====
I've heard about this worm running rampant on the Internet. Is there
anything I can do to protect myself from it?


====Resolution====
Nimda is a worm that uses an exploit of MS Internet Explorer, version
5.5 or below. The exploit causes a binary attachment to be opened
and run without your permission or knowledge. This exploit can be
triggered by visiting a rogue web page or by receiving an HTML email
message containing the worm. Although the flaw is with Internet Explorer
you are vulnerable when using MS Outlook and Outlook Express because
these programs use Internet Explorer to interpret the HTML email
message. If you use Outlook, Outlook Express or Internet Explorer
(versions 5.5 or lower) you should get the MS01-020 Security patch from
Microsoft and apply it to your version of Internet Explorer. (Note,
if you've applied Internet Explorer Service Pack 2 you should already
be safe from this exploit). The URL below links to the MS01-020 Microsoft 
Security Bulletin.
  
http://www.microsoft.com/technet/security/bulletin/MS01-020.asp
  
Once you're patched IE you still must refrain from opening attachments
that you weren't expecting. This worm, like so many others uses address
books to send email to unsuspecting folks. This email will appear to come
from someone you know. Especially don't open any attachments with .exe
or .vbs extensions. This worm is known to send an attachment named
readme.exe.
  
Other strategies: Another approach to protect from this problem is to
use non-Microsoft email or and web browsing software which tends to be
less vulnerable to these types of problems.  Some available alternatives
are:
  
Netscape, web browser and email, download from www.netscape.com or
contact help@swcp.com to have it sent to you on CDROM ($5).
  
Opera, web browser and email, download from www.opera.com.  (You can
download a free version which displays advertising, or pay $40 for the
regular version).
  
Eudora, for email, download from www.eudora.com.
  
Nimda is a fairly sophisticated worm that exploits a number of different
security flaws. If you're running a MS web server you should take a look
at http://www.cert.org/advisories/CA-2001-26.html for more information on
how the worm propagates and what you need to patch to avoid being used
as a place for the worm to propagate.
  


====Related URLS====
  http://www.microsoft.com/technet/security/bulletin/MS01-020.asp
  http://www.mcafee.com/anti-virus/viruses/nimda/default.asp?cid=2444
  http://www.sarc.com/avcenter/venc/data/w32.nimda.a@mm.html
  http://www.cert.org/advisories/CA-2001-26.html