New virus on the rounds, Nimba/readme.exe

While updating my virus thingy on our network, I spotted this recent addition to respective virus databases.

A computer worm that spreads to both servers and PCs running Microsoft software flooded the Internet with data on Tuesday.

Known as "Nimda" or "readme.exe," the worm spreads by sending infected e-mails, copying itself to computers on the same network and compromising Web servers using Microsoft IIS web software.

The server component of the virus exploits an old and previously patched flaw in IIS called the Unicode Directory Traversal vulnerability.

In addition to its ability to cross between servers and PCs, the Nimda worm seems to be more virulent because it automatically executes in Microsoft's Outlook e-mail software under the program's "medium" security setting.

"There appears to be a MIME exploit," said Eric Chien, chief researcher for antivirus software maker Symantec's European operations. "It appears that it is doing some kind of exploitation in e-mail."

SARC has the following details...

Also, the worm will create an open network share allowing access to the system. The worm will also attempt to spread via open network shares.