CRITICAL READING:
Central Command
Symantec
McAfee
Sophos
They have info on removing the virus and more specific info on what the virus actually is.
Here's my news post regarding Nimda on September 18:
Oh, yes, I'm having lots of fun. We (the ISP where I work) were hit today by a new virus named Nimda.
It's a nasty little bugger. Hacks into IIS and uploads a propogation program. Isn't that nice? It propogated across several million computers and servers in one day.
Check your C drive for a share setting. Open My Computer and right-click C:. Click "sharing..." MAKE SURE ALL SHARES AND WEBSHARES ARE OFF.
Open the C:, D:, and E: drives (if you have them) and look for admin.dll. If you have it, you're infected. The best way to keep IIS from propgating it (or to prevent further infection) is to open %systemroot\system32\drivers\etc\services and change the following line:
tftp 69/udp
to:
tftp 0/udp
Install all of the servicepacks and updates for your OS. Get a good anti-virus program installed and update to the latest definitions or check the anti-virus sites for hotfixes. here's the big 3:
Sophos
McAfee
Symantec
There should be links to the latest info on the virus on the front pages.
To stop the MIME vulnerability in Outlook Express and Internet Explorer, create a file named eml.reg or something and put the following text in the file:
REGEDIT4
[HKEY_CLASSES_ROOT\.eml]
@="Microsoft Internet Mail Message"
"Content Type"="text/plain"
Execute the reg file and IE5.0 and 5.5 and Outlook express won't be affected by the malicious .eml file that the worm attatches to the end of web pages. NOTE: this may affect Outlook since the .eml is an extension used for mail stores. Use at your own risk.
If you're lucky enough to be running Linux or have a Linux router, run this script:
#!/bin/sh
for LUSER in `grep "winnt" /var/log/httpd/error_log | awk '{print $8}' | sed -e s/]//`; do
if [ ! "`ipchains -L -n | grep $LUSER`" ]
then ipchains -A input -s $LUSER -d 0/0 -j DENY
fi
done
This script will block all of the guys that are infected and keep your bandwidth from being hogged.
