Windows Forum

Ask something
Discussion Locked

Possible Nimda attack

0 helpful
8 replies

by stergios_nik

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hello,

I have a web server IIS 4. I have installed both the Security roll up package that covers all the vulnerabilities till SP6a and the patch for Web folder traversal directory vulnerability.

Recently, Norton Antivirus on server reported NIMDA activity in C:\INETPUB\SCRIPTS\TFTP546

Norton says that file can not be repaired. I click oK! I downloaded the latest definitions from Norton and performed a full scan. Norton said that there is no virus.

I have stopped the REMOTE ADMIN SITE of IIS 4. Also, I removed the shares C$ in my local drivers.

Does anybody know what is going on?

Thanks in advance.

8 replies

by evansed1

Norton may have deleted the file, check the log files and make sure. So when you ran the new definitions there was nothing there. Any open share that is not password protected will invite Nimda. It was pretty prevalent at our site, so much so that anyone with an open share would be infected by logging into the net in less than 3 minutes.

by xanderoth

Hello! Nimda eh? Well that bugger is no fun at all. Just as important as ensuring your own server is free and clear and protected, you must also do the same on any machine on the local network. Ensure your norton is set to scan all files and runit again. Sometimes AV utilities just plain don't work finding Nimda (forget what others may say- its true!) You may want to scan your drive manually for .eml or .nws files with very long filenames.

Check the Norton scan log for details on whatit did to your infected file. If it deleted it, then you probably dont need to worry too much. Remember all open shares are accessable to the nimda across the network, not just the admin shares.

by isys

Have you applied the disinfecting procedures for NIMDA? That will be the acid test to see if you indeed have an infection. I would not place total reliance on what your AV solution is saying, esoecially since you appear to be getting conflicting opinions from it. Look for yourself to be sure.

by ds9

nimda (latest version) is a Stealth Trojan Horse. It replicates itself under a new extension name after each attack. It then hides itself sets the H attribute as well as the one that Microsoft doesn't tell you about, the "Lock" attribute which keepsyou (and Norton) from deleting it. Therefore it will not be in the latest Virus Definitions table. It activates on or about the 20th of every month, and the new versions (the last one we had), started out by immediately deleting all Norton software, then proceded to the C:\ root drive and ate us alive.

We could not even boot the machine because boot.ini was gone.

I recommend doing what we did. We obtaind a CDRW drive, and now we BURN cd's of all our servers sice we already know in advance that we will probably have to rebuild each one from the ground up if they get hit again.

Lot's & Lot's of Luck to you.

Cheers
George

This discussion is closed to new replies.