BBC NEWS Americas Africa Europe Middle East South Asia Asia Pacific Arabic Spanish Russian Chinese Welsh

 You are in: Sci/Tech
Front Page 
UK Politics 
Talking Point 
In Depth 

Commonwealth Games 2002

BBC Sport

BBC Weather

Thursday, 20 September, 2001, 12:45 GMT 13:45 UK
Nimda virus 'on the wane'
Worm can spread over the internet
Nimda worm scans webpages for e-mail addresses
The outbreak of the Nimda Windows worm, which has spread rapidly across the internet, appears to have peaked, say computer experts.

They have described Nimda as the fastest-spreading computer virus ever.

"We don't yet have a real idea of the extent of damage related to this worm, but we do know that this virus is creating quite a lot of commotion worldwide," said Joe Hartmann of computer security company Trend Micro.

The bug, which first appeared late on Tuesday, tries almost every trick in the book to infect computers, but its impact appears to be waning as companies and users install anti-virus software to counter the worm.

"Since late yesterday the number of infected web servers has come down," said Mr Hartmann.

"A lot of users have upgraded and done what they need to do to take care of the problem."

Stopping Nimda

But the mere existence of the worm forced some companies to shut down parts of their networks to prevent infection or further exposure.

Avoiding Nimda
Be wary of unexpected blank e-mail messages with long subject lines and attachments
If you receive a message like this delete it without reading it
If you use Outlook with Windows 98 or Windows 2000, install Microsoft's security patch that stops viruses like Nimda
Install anti-virus software and keep it up to date
If you have been infected, use clean-up programs from anti-virus companies to expunge it from your computer
The highest concentration of infected systems was in Canada, Denmark, Italy, Norway, the UK and the United States.

But it may take some time before the full extent of the damage caused by Nimda is known, as many computers may still be infected but be cut off behind firewalls.

Experts fear the attacks could prove to be more widespread than the Code Red infections of July and August, which caused an estimated US$2.6 billion in damage.

Business 'ground to a halt'

A British businesswoman who e-mailed BBC News Online said the worm had had a devastating effect on her website.

"The computers were rendered inoperable by the fact that many thousands of infected files were being created, and deleting them and deleting the Recycle Bin seemed to make them replicate faster," said Sarah Mabbitt of Avidstitch. "The entire hard disks and memory were used up.

"My business has ground to a halt and I do not yet know what damage has been done to vital files," she said.

The worm first appeared in the United States on Tuesday and spread to Asia overnight. Thousands of European businesses began work on Wednesday with infected computer systems.

The worm, the name of which spells admin backwards, arrives in electronic mail without a subject line and contains an attachment titled "readme.exe" disguised as an audio file.

It also scans webpages for e-mail addresses and sends a message to that site with a copy of the worm attached.

It can also interrogate copies of a program called Microsoft Exchange that many companies use as a "post office" for the e-mails and messages of their staff.

The worm can also copy itself to any shared directories it finds on networks it has compromised.

See also:

19 Sep 01 | Sci/Tech
Nimda virus loose online
19 Sep 01 | Sci/Tech
Q&A: The Nimda virus
06 Aug 01 | Sci/Tech
New worm infects the net
02 Aug 01 | Sci/Tech
Code Red threat tailing off
01 Aug 01 | Sci/Tech
Code Red keeps world guessing
31 Jul 01 | Sci/Tech
Internet put on Code Red alert
Internet links:

The BBC is not responsible for the content of external internet sites

Links to more Sci/Tech stories are at the foot of the page.

E-mail this story to a friend

Links to more Sci/Tech stories