Forum for Science, Industry and Business

Sponsored by:     3M 
Search our Site:

 

SYMANTEC PROVIDES COMPREHENSIVE PROTECTION AGAINST W32.NIMDA.A@MM

19.09.2001



New Analysis of Computer Worm Indicates Additional Destructive Payload

Symantec Corp. (Nasdaq: SYMC), a world leader in Internet security, today announced that new analysis of W32.Nimda.A@mm reveals that the worm contains an additional destructive payload that will not only require detection, but removal. The new analysis indicates that the worm is a file infector, overwriting .exe files.

W32.Nimda.A@mm is a mass-mailing worm that utilizes multiple methods to spread itself. The worm sends itself out by e-mail, infects machines over the network, and infects unpatched or already vulnerable Microsoft IIS Web servers. The worm also has various side effects, such as increasing network traffic while searching for machines to infect, which may cause network bandwidth problems. W32.Nimda.A@mm will also attempt to create security holes by creating a guest account with administrator privileges and create open shares on the infected system.

Symantec currently provides an integrated detection and repair solution against W32.Nimda.A@mm. In one step, users can download a cure that will simultaneously detect the worm and repair damaged files. The new definitions are available through Symantec’s LiveUpdate feature or from the Symantec Web site http://www.securityresponse.symantec.com/avcenter/download.html "Using blended Internet security threats - the combination of viruses, exploits, or vulnerabilities - to attack businesses and destroy assets, continue to rise," said Vincent Weafer, senior director of Symantec Security Response. "For the first time, to combat such a fast spreading threat, Symantec integrated its solution for W32.Nimda.A@mm to detect and repair in one seamless step. The integrated solution allows for quick clean up with little downtime, while preventing additional infections."

Symantec Security Response recommends that IT administrators implement the following to stop the propagation of W32.Nimda.A@mm:

  • Block e-mails containing a "readme.exe" attachment.

  • Update virus definitions and ensure that firewalls are correctly configured.

  • Download the latest security updates for Enterprise Security Manager and NetRecon.

  • Install the IIS Unicode Transversal security patch.

  • Install the malformed MIME header execution security patch.

  • Close network share drives.

Additionally, consumers can immediately protect themselves against the new worm by implementing the following:

  • Use Symantec’s LiveUpdate feature to obtain the latest virus definitions.

  • Use the Windows Update feature located on the "Start" menu on Window 95 and higher systems to download new security patches.

  • Disable the "File Download" feature in Internet Explorer to prevent compromise.

Both consumers and enterprises can be infected through a variety of methods.

  • E-mail - One of the methods the worm infects PCs though is e-mail. The e-mail arrives with an attachment - readme.exe that is not always visible and contains a randomly generated subject line and no body message. The worm uses its own SMTP engine to e-mail itself out to all the addresses it collects by searching the user’s incoming and outgoing e-mail boxes. Internet Explorer users v5.01 or v5.5 - (IE 5 with the Service Pak 2 or later installed or IE 6 are not affected) will receive a blank e-mail - no subject line, no body and a hidden attachment. Just opening the e-mail can infect user’s PCs. For the latest Microsoft security patch, visit http://www.microsoft.com/windows/ie/download/critical/q290108/default .asp.

  • Shared Drives - PC users with shared drives enabled are also at risk. The worm searches for open network shares and will attempt to copy itself to these systems and then execute. IT administrators should close all network shared drives.

  • Web sites -When users visit a compromised Web site, the server will run a script attempting to download an Outlook file, which contains the W32.Nimda.A@mm worm. The worm will create an open network share on the infected machine allowing access to the system. W32.Nimda.A@mm specifically targets versions of IIS servers, taking advantage of the known Universal Web Traversal exploit (MS Security Bulletin MS00-078), which is similar to the exploit used in the Code Red attack. Compromised servers will display a Web page and attempt to download an Outlook file that contains the worm as an attachment. IT Administrators should download the Microsoft security patch for IIS 4.0 athttp://www.microsoft.com/downloads/Release.asp?ReleaseID=32061 and for IIS v5.0 at http://www.microsoft.com/downloads/Release.asp?ReleaseID=32011.

Symantec provides additional protection against W32.Nimda.A@mm through the following solutions:

  • Enterprise Security Manager -Symantec’s policy compliance and vulnerability management system, helps manage security patch update functions. New patch templates are available that detect the underlying vulnerability on Windows NT 4.0 and Windows 2000 servers.

  • NetProwler - Symantec’s network-based intrusion detection tool, with Security Update 8 installed, is capable of detecting attempts to attack IIS 4.0 and 5.0 servers through this vulnerability.

  • NetRecon - Symantec’s network vulnerability assessment tool will be updated to detect if this vulnerability exists on a system and if so will provide recommendations on how to fix it.

  • Symantec Enterprise Firewall (Raptor Firewall) - Symantec’s application inspection firewall, by default, blocks suspect outbound data traffic from web servers, like IIS, when operating on the firewall’s service network, thereby stopping the propagation of this, as well as other types of attacks.

  • Symantec Security Check - This service, www.symantec.com/securitycheck, has been updated to scan if a system is vulnerable to this exploit.

  • Norton Internet Security - Symantec’s integrated security and privacy suite for consumers can be updated to ensure only trusted programs access the Internet.

Über Symantec Symantec ist weltweit marktführend auf dem Gebiet der Internet-Sicherheit. Die umfangreiche Palette an Lösungen in den Bereichen Content und Network Security für Privatanwender und Unternehmen umfasst Virenschutz, Firewalls und Virtual Private Networks ebenso wie Vulnerability Management, Intrusion Detection, Internet- und E-Mail-Filter sowie Technologien für die Remote-Verwaltung und Sicherheitsservices für Unternehmen weltweit. Die Consumermarke für Sicherheitsprodukte Norton ist weltweit marktführend im Einzelhandel und hat zahlreiche Auszeichnungen der Branche bekommen. Das im Jahr 1982 gegründete Unternehmen ist in Cupertino, Kalifornien, beheimatet und vertreibt seine Produkte in 37 Ländern. Für mehr Informationen besuchen Sie uns unter

Andrea Wolf | ots
Further information:
http://www.symantec.com/securitycheck,
http://www.microsoft.com/downloads/Release.asp?ReleaseID=32061
http://www.microsoft.com/downloads/Release.asp?ReleaseID=32011

More articles from Communications Media:

nachricht Product placement: Only brands placed very prominently benefit from 3D technology
07.07.2016 | Alpen-Adria-Universität Klagenfurt

nachricht NASA Goddard network maintains communications from space to ground
02.03.2016 | NASA/Goddard Space Flight Center

All articles from Communications Media >>>

The most recent press releases about innovation >>>

Die letzten 5 Focus-News des innovations-reports im Überblick:

Im Focus: Novel silicon etching technique crafts 3-D gradient refractive index micro-optics

A multi-institutional research collaboration has created a novel approach for fabricating three-dimensional micro-optics through the shape-defined formation of porous silicon (PSi), with broad impacts in integrated optoelectronics, imaging, and photovoltaics.

Working with colleagues at Stanford and The Dow Chemical Company, researchers at the University of Illinois at Urbana-Champaign fabricated 3-D birefringent...

Im Focus: Quantum Particles Form Droplets

In experiments with magnetic atoms conducted at extremely low temperatures, scientists have demonstrated a unique phase of matter: The atoms form a new type of quantum liquid or quantum droplet state. These so called quantum droplets may preserve their form in absence of external confinement because of quantum effects. The joint team of experimental physicists from Innsbruck and theoretical physicists from Hannover report on their findings in the journal Physical Review X.

“Our Quantum droplets are in the gas phase but they still drop like a rock,” explains experimental physicist Francesca Ferlaino when talking about the...

Im Focus: MADMAX: Max Planck Institute for Physics takes up axion research

The Max Planck Institute for Physics (MPP) is opening up a new research field. A workshop from November 21 - 22, 2016 will mark the start of activities for an innovative axion experiment. Axions are still only purely hypothetical particles. Their detection could solve two fundamental problems in particle physics: What dark matter consists of and why it has not yet been possible to directly observe a CP violation for the strong interaction.

The “MADMAX” project is the MPP’s commitment to axion research. Axions are so far only a theoretical prediction and are difficult to detect: on the one hand,...

Im Focus: Molecules change shape when wet

Broadband rotational spectroscopy unravels structural reshaping of isolated molecules in the gas phase to accommodate water

In two recent publications in the Journal of Chemical Physics and in the Journal of Physical Chemistry Letters, researchers around Melanie Schnell from the Max...

Im Focus: Fraunhofer ISE Develops Highly Compact, High Frequency DC/DC Converter for Aviation

The efficiency of power electronic systems is not solely dependent on electrical efficiency but also on weight, for example, in mobile systems. When the weight of relevant components and devices in airplanes, for instance, is reduced, fuel savings can be achieved and correspondingly greenhouse gas emissions decreased. New materials and components based on gallium nitride (GaN) can help to reduce weight and increase the efficiency. With these new materials, power electronic switches can be operated at higher switching frequency, resulting in higher power density and lower material costs.

Researchers at the Fraunhofer Institute for Solar Energy Systems ISE together with partners have investigated how these materials can be used to make power...

All Focus news of the innovation-report >>>

Anzeige

Anzeige

Event News

ICTM Conference 2017: Production technology for turbomachine manufacturing of the future

16.11.2016 | Event News

Innovation Day Laser Technology – Laser Additive Manufacturing

01.11.2016 | Event News

#IC2S2: When Social Science meets Computer Science - GESIS will host the IC2S2 conference 2017

14.10.2016 | Event News

 
Latest News

UTSA study describes new minimally invasive device to treat cancer and other illnesses

02.12.2016 | Medical Engineering

Plasma-zapping process could yield trans fat-free soybean oil product

02.12.2016 | Agricultural and Forestry Science

What do Netflix, Google and planetary systems have in common?

02.12.2016 | Physics and Astronomy

VideoLinks
B2B-VideoLinks
More VideoLinks >>>