A computer worm that spreads to both servers and PCs running Microsoft software flooded the Internet with data on Tuesday. Known as "Nimda" or "readme.exe," the worm spreads by sending infected e-mails, copying itself to computers on the same network, and compromising Web servers using Microsoft's Internet Information Server (IIS) software. Analysis of the worm is still in the early stages, experts said. The server component of the virus exploits an old and previously patched flaw in IIS called the Unicode Directory Traversal vulnerability. In addition to its ability to cross between servers and PCs, the Nimda worm seems to be more virulent because it automatically executes in Microsoft's Outlook e-mail software under the program's "medium" security setting. Apparently, no common antivirus software was able to detect the worm as of Tuesday morning, though several companies are close to producing updated definitions to identify and block the program.
Link of interest: Check out the following SARC (Symantec AntiVirus Research Centre) webpage to get more details about the worm.
|