L-144b: The W32.nimda Worm

September 18, 2001 23:00 GMT
Revised: September 21, 2001 23:00 GMT
Revised: September 25, 2001 23:00 GMT

[Revised 9/21/01 Added technical details]
[Revised 9/25/01 Added warning about explorer preview]

The W32.nimda worm started spreading on September 18, 2001 and quickly spread throughout the Internet. Unlike the CodeRed worm, which targets only IIS servers, the Nimda worm attacks both servers and client systems using four different propagation methods. Those methods are: file infections, mass e-mail of infected attachments, web server attacks, and LAN propagation via shares. The mixture of capabilities has resulted in a Worm that is very complicated, difficult to analyze, and difficult to repair its damage. The type of attacks performed and damage done is dependent on the name of the worm executable that is run and any command line arguments. The result is that when exmining an infected system you may only see some of the effects listed in this Advisory.

WARNING! When examining an infected system or when examining files taken from an infected system you can be infected by the worm by simply clicking on an infected file. You are vulnerable to this type of infection if your system has one of the vulnerable versions of Internet Explorer and you are using "Web Style" folders. Web style folders automatically preview the selected file in the lower-left corner of the folder window. Previewing the file readme.eml or any infected web page causes the worm to run. If "Web Style" folders are turned off (that is, you are using "Classic Style" folders) or you have a patched version of Internet Explorer you are not vulnerable.

Worm Operation

There is an excellent detailed description of the operation of this worm available on the F-Secure website that is summarized here. The worm uses four different methods to propagate itself to other systems: file infections, mass e-mail, web server attacks, and LAN shares.

File Infections

The Nimda worm infects executable (.EXE) files it finds on systems. This method is similar to more traditional virus infections but with a twist. Instead of attaching the worm code to the beginning or end of the executable, the worm takes the executable code into itself and then renames itself  to the name of the infected executable. When the executable is run, the worm runs first, extracts the original executable, and runs it.

Mass E-mail

Using its own built-in mailer, the worm extracts e-mail addresses from your existing address books, mail in your inbox, and from web pages in your web cache. The e-mails are constructed with no apparent body, faked return addresses, and an attachment called README.EXE. The attachment is a copy of the worm. If you read the e-mail and run the attachment, you will be infected with this worm. On some e-mail readers, the attachment is executed automatically when you simply view the e-mail message. This automatic execution occurs because some e-mail readers use Internet Explorer windows to display html encoded mail messages and the worm exploits the vulnerability in Internet Explorer described in Microsoft security bulletin MS01-020.

Mail readers that use an Internet Explorer window to view html encoded e-mail include: Outlook, Outlook Express, and Eudora. There are likely others. The vulnerable versions of Internet Explorer are:

• Internet Explorer 5.01 Service Pack 1 and earlier
• Internet Explorer 5.5 Service Pack 1 and earlier

Internet Explorer 5.01 and 5.02 with Service Pack 2 and Internet Explorer 6 are not vulnerable. Netscape web browsers and mail readers are also not vulnerable. Text only mail readers are not vulnerable.

Web Server Attacks

After the worm is establisned in a system, it searches for web servers and tries a series of directory traversal, unicode, and other attacks. All of these attacks are prevented by applying the cumulative patch kit described in Microsoft bulletin MS01-044. It also attempts to exploit changes made to a system by prior CodeRed II attacks. If the attack is successful, the worm attaches code to the ends of a random list of web pages on the server that attempt to exploit the same Internet Explorer vulnerability as was used in the mass e-mail attack. Anyone viewing these web pages with a vulnerable web browser will be infected with the worm.

LAN Share Attacks

The worm adds the "guest" account to compromised systems with no password and puts it in the Guest and Administrators groups. This opens a system up for anyone to login and take complete control of a system. The worm also opens the full C drive for sharing to anyone. After opening up the compromised system, the worm looks for other networked systems with shares that it can open. When it finds open shares, it attempts to spread itself by planting copies of the infected e-mail message and an infected copy of RICHED20.DLL in the shares. The library RICHED20.DLL is used by Word, Wordpad, and Outlook. If the owner of the share opens the infected e-mail or opens a Word, Wordpad, or Outlook document in that directory, the shared machine will be compromised.

Detecting An Infected System

Detecting an infected system is difficult with this worm as the infections are different depending on the name of the file that ran to start the infection process and the command line used to start it. The worm also actively tries to hide itself. The best way to test a system is to run an antivirus scanner on the system to test for infected files. Note that detecting readme.exe in your e-mail attachments directory may only indicate that the worm was sent to you but has not yet been executed. Finding many infected files in a system is strong evidence that it is infected.

One problem with both servers and client systems is that nimda changes the registry entries that control viewing hidden files and file extensions. When looking in a directory for files, choose the View, Folder Options, View Tab in the Windows Explorer.  In the Advanced settings window, choose "Show all files", uncheck "Hide file extensions for known file types", and click OK. Check these settings whenever you search a different directory as the worm will continue to change them back to the hidden settings. In fact, if you change these settings and a few minutes later find out that for the same directory they have been changed back, that is a good indication that the worm is active in your system.

Servers

If the system in question is an IIS web server, look for admin.dll in the web server's \scripts directory. Finding admin.dll in the _vti_bin\_vti_adm directory is normal as this is the FrontPage extension for admiistering a website. It should not be found in the \scripts directory. If you open the suspect admin.dll file in notepad, you will find the strings listed in the "Detecting Infected Packet Traffic" section of this document.

Look in directories containing .DOC or .EML files and see if you can find RICHED20.DLL or README.DLL in those directories. Note that these files may be hidden and you may have to turn on viewing of hidden files to see them.

Look in the web folders that contain .HTM, .HTML, or .ASP files for README.EML.

Clients

Look for README.EXE in the mail attachments folder. Look for files in the temporary directory (\temp, \windows\temp, \winnt\temp) with the name MEP*.TMP and MEP*.TMP.EXE (the * is any random characters). These files may be hidden so you must turn on viewing of hidden files to see them. Look for LOAD.EXE in the \windows or \winnt directories. Open the \windows\system.ini file with a text editor like notepad and look for the line: "shell=explorer.exe load.exe -dontrunold". If you find any of these files, your system is infected.

Detecting Infected Packet Traffic

Detecting infected packet traffic involves finding unique strings to look for. The following strings are detectible in the unpacked executables (admin.dll, readme.exe) and in the infected e-mail message. Some easy to spot markers are the mime tags (--====_ABC1234567890DEF_====), the string after src= in the <iframe> tag (3Dcid:EA4DMGBP9p), and the name of the attachment (name="readme.exe").

boundary="====_ABC1234567890DEF_===="
X-Priority: 3
X-MSMail-Priority: Normal
X-Unsent: 1

--====_ABC1234567890DEF_====
Content-Type: multipart/alternative;
	boundary="====_ABC0987654321DEF_===="

--====_ABC0987654321DEF_====
Content-Type: text/html;
	charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable


<HTML><HEAD></HEAD><BODY bgColor=3D#ffffff>
<iframe src=3Dcid:EA4DMGBP9p height=3D0 width=3D0>
</iframe></BODY></HTML>
--====_ABC0987654321DEF_====--

--====_ABC1234567890DEF_====
Content-Type: audio/x-wav;
	name="readme.exe"
Content-Transfer-Encoding: base64
Content-ID: <EA4DMGBP9p>

    Voice:          +1 925-422-8193 (7 x 24)
    FAX:            +1 925-423-8002
    STU-III:        +1 925-423-2604
    E-mail:          ciac@ciac.org
    World Wide Web:  http://www.ciac.org/
    Anonymous FTP:   ftp.ciac.org