Nimda Detection & Clean: Complete Guide to Finding and Removing the Worm
Nimda is a fast-spreading worm that targeted Windows systems in 2001, exploiting multiple vectors (email, network shares, IIS vulnerabilities, and crafted web requests). Although old, variants and similar multi-vector threats still appear, and the techniques below remain useful for detecting and cleaning such infections. This guide covers detection indicators, investigation steps, containment, removal, and post‑incident hardening.
1. Quick overview of Nimda behavior
- Propagation vectors: infected email attachments, open network shares, multibyte malformed HTTP requests targeting Microsoft IIS, and infected web content (defacement or malicious file upload).
- Common footprints: altered or newly created executable files in web directories, changed IIS script maps, added autorun entries, new/modified scheduled tasks, and abnormal network traffic (scanning and SMB propagation).
- Targets: Windows servers and workstations (older Windows NT/2000/XP era), especially systems with unpatched IIS or SMB shares.
2. Detection indicators (what to look for)
- Filesystem changes
- New or modified executables (.exe, .dll) in web root folders (e.g., C:\inetpub\wwwroot), Windows system folders, or user profile directories.
- Unexpected files named similarly to system files or using random names; look for recently changed timestamps.
- Web server anomalies
- IIS log entries with suspicious request patterns (long, malformed URLs, strange query strings, or repeated attempts to access known vulnerable scripts).
- Unusual ⁄500 error spikes or requests to newly added pages that serve malicious content.
- Email and mailbox signs
- Outbound emails with suspicious attachments or new mass-mailing behavior originating from internal hosts.
- Process and autorun evidence
- Unknown running processes, services, or DLLs loaded into trusted processes (e.g., rundll32.exe).
- New registry autorun keys under HKLM\Software\Microsoft\Windows\CurrentVersion\Run or HKCU equivalents.
- Network activity
- Increased SMB traffic, scanning behavior (lots of connection attempts to port ⁄139), or outbound connections to strange hosts.
- Multiple internal hosts contacting the same external IP or domain shortly before symptoms.
- System instability
- Slower system performance, frequent crashes, or unexpected restarts.
3. Preparing before you act
- Isolate affected hosts immediately from the network to stop further spread. If possible, disconnect network cables or disable network interfaces rather than shutting down (to preserve volatile evidence).
- Preserve evidence: collect volatile data (running processes, network