https://wiki.swcp.com/w/index.php?action=history&feed=atom&title=KB_132 2026-10-06T22:38:59Z Revision history for this page on the wiki MediaWiki 1.45.1 https://wiki.swcp.com/w/index.php?title=KB_132&diff=393&oldid=prev 2008-06-04T22:50:29Z

<p>New page: ===What should I do about the Nimda worm?=== Article:132 Created:2001-09-19 00:04:43 Categories: E-mail Security ====Question or Symptom==== I&#039;ve heard about this worm running ra...</p> <p><b>New page</b></p><div>===What should I do about the Nimda worm?===<br /> Article:132<br /> Created:2001-09-19 00:04:43<br /> Categories:<br /> E-mail<br /> Security<br /> <br /> ====Question or Symptom====<br /> I&#039;ve heard about this worm running rampant on the Internet. Is there<br /> anything I can do to protect myself from it?<br /> <br /> <br /> ====Resolution====<br /> Nimda is a worm that uses an exploit of MS Internet Explorer, version<br /> 5.5 or below. The exploit causes a binary attachment to be opened<br /> and run without your permission or knowledge. This exploit can be<br /> triggered by visiting a rogue web page or by receiving an HTML email<br /> message containing the worm. Although the flaw is with Internet Explorer<br /> you are vulnerable when using MS Outlook and Outlook Express because<br /> these programs use Internet Explorer to interpret the HTML email<br /> message. If you use Outlook, Outlook Express or Internet Explorer<br /> (versions 5.5 or lower) you should get the MS01-020 Security patch from<br /> Microsoft and apply it to your version of Internet Explorer. (Note,<br /> if you&#039;ve applied Internet Explorer Service Pack 2 you should already<br /> be safe from this exploit). The URL below links to the MS01-020 Microsoft <br /> Security Bulletin.<br /> <br /> http://www.microsoft.com/technet/security/bulletin/MS01-020.asp<br /> <br /> Once you&#039;re patched IE you still must refrain from opening attachments<br /> that you weren&#039;t expecting. This worm, like so many others uses address<br /> books to send email to unsuspecting folks. This email will appear to come<br /> from someone you know. Especially don&#039;t open any attachments with .exe<br /> or .vbs extensions. This worm is known to send an attachment named<br /> readme.exe.<br /> <br /> Other strategies: Another approach to protect from this problem is to<br /> use non-Microsoft email or and web browsing software which tends to be<br /> less vulnerable to these types of problems. Some available alternatives<br /> are:<br /> <br /> Netscape, web browser and email, download from www.netscape.com or<br /> contact help@swcp.com to have it sent to you on CDROM ($5).<br /> <br /> Opera, web browser and email, download from www.opera.com. (You can<br /> download a free version which displays advertising, or pay $40 for the<br /> regular version).<br /> <br /> Eudora, for email, download from www.eudora.com.<br /> <br /> Nimda is a fairly sophisticated worm that exploits a number of different<br /> security flaws. If you&#039;re running a MS web server you should take a look<br /> at http://www.cert.org/advisories/CA-2001-26.html for more information on<br /> how the worm propagates and what you need to patch to avoid being used<br /> as a place for the worm to propagate.<br /> <br /> <br /> <br /> ====Related URLS====<br /> http://www.microsoft.com/technet/security/bulletin/MS01-020.asp<br /> http://www.mcafee.com/anti-virus/viruses/nimda/default.asp?cid=2444<br /> http://www.sarc.com/avcenter/venc/data/w32.nimda.a@mm.html<br /> http://www.cert.org/advisories/CA-2001-26.html</div>

Jamii