New 'Nimda' worm variant strikes the Net

November 2, 2001

A new variant of the infamous "Nimda" worm has appeared on the Internet and is spreading in the wild. Though it is undetermined whether this variant of the worm will be more or less serious than the original 'Nimda' all users are urged to patch their systems as soon as possible to prevent infection.

The original 'Nimda' worm created confusion on the Internet in mid September, spreading itself as an e-mail attachment, through shared hard disks on networks and by infecting users who browsed Web pages hosted on infected servers.

'Nimda' had spawned three variants before Tuesday: "Nimda.b", "Nimda.c", and "Nimda.d", although none were particularly different from the original.

The most recent version, however, "Nimda.e," is a recompiled version of the original worm, according to anti-virus vendors.

That the new variant is a recompiled version points out that the original author has made changes to the worm and re-released it.

'Nimda' was originally fought using a mixture of e-mail and Web filters, anti-virus updates, and updates to Microsoft's IE (Internet Explorer) Web browser, which is the browser exploited to automatically download the worm.

The current variant so far is nowhere near the spread of the original 'Nimda', nonetheless, all users are recommended to upgrade their browsers and update their anti-virus software.