LHRIC > Technical Services > Virus Alert

	TECHNICAL SERVICES
	home \| search \| contact \| Virus Central
	Providing timely, reliable & cost-effective technical support

Virus Central - Detailed

Virus Information
Name:	W32/Nimda@MM
Aliases:
Type:	Virus
Discovery Date:	09/18/2001
Detection:	- Presence of the files C:\ADMIN.DLL, D:\ADMIN.DLL, and E:\ADMIN.DLL - Presence of many .EML files with the same name (typically README.EML or DESKTOP.EML) - Surprisingly open network shares
Virus Description:	This threat exploits various Microsoft vulnerabilities. It is contractible via web browsing, reading an email message, or simply running the IIS web server.
E-mail Subject:	The email subject line varies, message body is blank,
E-mail Body:
Attachment:	Attachment name varies (most often README.EXE) and may use the icon for an Internet Explorer HTML document.

Virus Effects:

The information provided here is as of 11:30am PDT September, 21, 2001.

This threat can infect all unprotected users of Win9x/NT/2000/ME.

Its main goal is simply to spread over the Internet and Intranet, infecting as many users as possible and creating so much traffic that networks are virtually unusable.

All users running Microsoft Internet Explorer (ver 5.01 or 5.5 without SP2), are advised to install this patch for the Incorrect MIME Header Can Cause IE to Execute E-mail Attachment vulnerability.

All IIS administrators (and Win2K users who may not know they are running IIS), who have not already done so, should also install this patch (August 15, 2001 Cumulative Patch for IIS)

This worm virus infects using several methods including: mass-mailing, network share propagation, the Microsoft Web Folder Transversal vulnerability (also used by W32/CodeBlue), and a Microsoft incorrect MIME Header vulnerability. It also attempts to create network shares, and utilize the backdoor created by the W32/CodeRed.c worm

The email subject line varies, message body is blank, and attachment name varies (most often README.EXE) and may use the icon for an Internet Explorer HTML document.

The most significant methods of propagation are as follows:

The email messages created by the worm specify a content-type of audio/x-wav and contain an executable attachment type. Thus when a message is accessed, the attachment can be executed without the user's knowledge. Simply viewing the page in Microsoft Outlook or Microsoft Outlook Express using the preview pane can infect you. Other mail clients can still receive these email messages, but double-clicking the attachment would be required to execute the virus. WinNT/2K systems cannot be infected from an email message.

When infecting, it appends .ASP, .HTM, and .HTML documents, and files named INDEX, MAIN, and DEFAULT, with javascript code which contains instructions to open a new browser window containing the infectious email message itself (taken from the dropped file README.EML). Thus when this infected web page is accessed (locally or remotely) the machine viewing the page is infected. In other words, simply visiting a web site that is compromised can infect your computer. WinNT/2K systems cannot be infected by accessing an infected .ASP, .HTM, or .HTML document.

When infecting, it creates network shares for each local drive as %$ (where % = the drive letter that is being shared). On Win9x/ME system this is configured as a full share with no password. On WinNT/2K system the user GUEST is given permission to the share and added to the group ADMINISTRATORS as well as GUESTS. A reboot is required in order for these shares to get created. When the virus finds an open share, it copies itself to each folder on the drive in .EML format as described later on in this description. This can include the START UP folder.

The worm scans IP addresses looking for IIS servers to infect via the Web Folder Transversal vulnerability by sending a malformed GET request. This causes vulnerable machines to initiate a TFTP session to download ADMIN.DLL from the machine which sent the request. Once downloaded the remote system is instructed to execute the DLL which infects that machine. In the event that the TFTP session fails to connect, multiple files (TFTP*) are created in the WINDOWS TEMP directory. These files are simply copies of the worm. It also tries to use the backdoor created by W32/CodeRed.c to infect.

.EXE files are prepended with the worm code.

Email addresses are gathered by extracting the email addresses from MAPI messages in Microsoft Outlook and Microsoft Outlook Express, as well as from HTM and HMTL documents. The worm then sends itself to these addresses with either no subject line or a subject line containing a partial registry key path.

Once infected, your system is used to seek out others to infect over the web. As this creates a lot of port scanning, this can cause a network traffic jam.

It may copy itself to the WINDOWS SYSTEM directory as LOAD.EXE and create a SYSTEM.INI entry to load itself at startup:
Shell=explorer.exe load.exe -dontrunold

Additional information:

- A MIME encoded version of the worm is created in each folder on the system (often as README.EML or DESKTOP.EML, can also be .NWS files). This can create a lot of files and in some cases even fill up a hard disk.
- The WININIT.INI file may be used to delete specific worm files upon reboot:
NUL=C:\WINDOWS\TEMP\MEP52b0.TMP.exe
- Registry key values are created/changed to hide files:

- A registry key branch is deleted to remove share security under WinNT/2K

- The worm saves a copy of itself to C:\, D:\, and E:\ as ADMIN.DLL

Note: a valid ADMIN.DLL does exist and is part of the Microsoft FrontPage Server Extentsions functionality

- Filenames for the worm include: ADMIN.DLL, LOAD.EXE, MMC.EXE, README.EXE, RICHED20.DLL, MEP*.TMP.EXE

Note: applications which utilize the rich text format, such as Microsoft Word and Wordpad, call this RICHED20.DLL file. As such, the worm is executed when a dependant program is run. There is typically a valid RICHED20.DLL file in the WINDOWS SYSTEM directory, but this is overwriten by the virus.

Note: MMC.EXE is the name for the Microsoft Management Console application. It has been reported that the worm can in fact overwrite this file.

Removal Instructions:

Removing this patching vulnerable systems, disabling network shares, and using the latest DAT files. It can not be removed manually.

Those using DAT versions < 4162 should update to the latest available DATs and remove any EXTRA.DAT files that they may be using. These current DAT files fix a problem with certain infected .EXE files being deleted when they should have been repaired.

Infected systems must:

apply the patches below

close any network shares prior to cleaning

exit any running applications

Stop a running IIS server

Scan and clean each drive

Restore the RICHED20.DLL and MMC.EXE files if they were overwritten by the virus and deleted by the scanner.

Failure to take these actions may result in reinfection.

Applying patches

All users running Microsoft Internet Explorer (ver 5.01 or 5.5 without SP2), are advised to install this Microsoft patch for the Incorrect MIME Header Can Cause IE to Execute E-mail Attachment vulnerability.

All IIS administrators (and Win2K users who may not know they are running IIS), who haven't already done so, should also install this Microsoft patch (August 15, 2001 Cumulative Patch for IIS)

Scanning/Removal

In cases where users with VirusScan and Netshield 4.5, or 4.51 have altered the "default extension list/program files extension list" the following package is required to scan files with extensions greater than 3 characters, and is required for complete detection of this threat where the extension list has been customized.
EXTFIX1.EXE patch . Please review the README.TXT file first.

As always, AVERT recommends that users configure VirusScan to scan all files. If this is not an option in your environment, the default extension list ("Program files" or "Default files") should be used.

Additionally Win9x users should remove the text: load.exe -dontrunold from the SYSTEM.INI file.

Stand Alone Removal Tool

Please note Virusscan and Netshield products will detect and remove the virus and the associated files the virus affects. It will NOT remove the network shares or the guest account created by W32/Nimda@MM.

Users that would like to have these changes removed automatically can use the AVERT NimdaScan (current version 1.0f) program located on the AVERT Tools Page. Please follow the instructions in the README.TXT when using the program.

VirusScan 4.03 and 4.50 issues

VirusScan 4.03 and VirusScan 4.50 will detect the W32/Nimda@MM virus if utilizing the correct engine and dat files in all cases, except when the virus comes on to a machine across a network share. VirusScan 4.03 and VirusScan 4.50 intercept calls made on the system to open files, read files, write files, etc. when made from the local machine. VirusScan 4.03 and VirusScan 4.50 do not intercept these calls when they are being made via a remote machine as happens when W32/Nimda@MM infects machines via network shares.

In order to resolve this issue computers must be updated to a minimum of VirusScan 4.50 Service Pack 1, current engine, and current Dats and also ensure that all machines on the network are running virus protection that will detect and clean this virus. The ability of the virus to travel via network shares is due to unprotected machines on the network.

Additional Windows ME Info:
NOTE: Windows ME utilizes a backup utility that backs up selected files automatically to the C:\_Restore folder. This means that an infected file could be stored there as a backup file, and VirusScan will be unable to delete these files. These instructions explain how to remove the infected files from the C:\_Restore folder.

Disabling the Restore Utility

1. Right click the My Computer icon on the Desktop.
2. Click on the Performance Tab.
3. Click on the File System button.
4. Click on the Troubleshooting Tab.
5. Put a check mark next to "Disable System Restore".
6. Click the Apply button.
7. Click the Close button.
8. Click the Close button again.
9. You will be prompted to restart the computer. Click Yes.
NOTE: The Restore Utility will now be disabled.
10. Restart the computer in Safe Mode.
11. Run a scan with VirusScan to delete all infected files, or browse the the file's located in the C:\_Restore folder and remove the file's.
12. After removing the desired files, restart the computer normally.
NOTE: To re-enable the Restore Utility, follow steps 1-9 and on step 5 remove the check mark next to "Disable System Restore".