Virus Nimda is a computer worm which can replicate and multiply itself through several methods.  When your system gets infected with this virus, you will be alerted by an error message while installing a Microsoft Office product. The Virus Nimda also spreads  through file transfers.

Nimda is a computer worm and a file infector. It is considered as one of the most notorious and most widespread virus worms because of its multiple propagation vectors.

Nimda has the propensity to afflict user workstations running Windows 95, 98, Me, NT, 2000 or XP operating systems, and servers running Windows NT and 2000.

Virus Nimda infects a computer through five different infection vectors:

    * It spreads through e-mail and e-mail attachments
    * It spreads through open network shares
    * It can enter a computer through ‘back doors’ left behind by the “Code Red II” and “sadmind/IIS” worms
    * It searches for Microsoft IIS security holes and attempts to copy itself
    * It can spread through browsing of compromised websites

Working of Virus Nimda

Virus Nimda collects the list of e-mail addresses saved in the victim’s address books in their e-mail clients like Microsoft Outlook and Eudora, and also from e-mail addresses present in HTML files.

Thereafter, it shoots an e-mail across to all the e-mail addresses without any subject and an empty body. In this e-mail, it attaches an attachment naming Readme.exe or Readme.eml, which is an executable file. The virus then makes use of .eml extension to develop a security defect in Microsoft Internet Explorer 5.

Virus Nimda spreads through shared network folders in order to infect executable files. In case your system is infected with this virus, it will replicate and spread through file transfers. It can also control a Microsoft IIS (Internet Information Server) Web server, by taking advantage of certain security holes.

If your system is infected with Virus Nimda, the following files will appear on your computer:

    * Readme.exe
    * Readme.eml
    * Files having the extension .nws
    * Files with a name like mep*.tmp, mep*.tmp.exe

Spelt backwards Nimda is “admin”. It spreads quickly and has been understood to even surpass the extent of damage brought about by “Code Red”. If your computer is infected with Virus Nimda, you will not be able to install any Office product on your system.
Get the most efficient computer security support at RPC through our technicians.