Nimda worms slows, some see continued spread

Despite a splashy entrance and a comprehensive set of attacks, the Nimda worm that spread quickly across the Internet Tuesday has slowed its pace Wednesday and is no longer substantially affecting network traffic, according to a number of Internet monitoring firms. Not all groups monitoring Nimda's spread, however, are so ready to write it off.

Data from network monitoring companies Matrix.net Inc. and Internet Traffic Report.com indicate that while Nimda had a serious effect on the Internet Tuesday, its impact has lessened substantially Wednesday. Nimda caused a drop in availability of about 2.5 percent among the nearly 1,300 Web sites Matrix.net regularly monitors for its data. While these sites are generally about 96 percent available and the average for the week since the terrorist attacks has been about 94 percent, the monitored sites were only about 91 percent to 92 percent available from early Tuesday until early Wednesday.

Internet Traffic Report.com's data also bears out Nimda's impact. Among other things, the site measures the average response time of Web servers to requests for information. Over the past week, the average response time has been 223 milliseconds. Beginning Tuesday morning, the time that Nimda appeared on the Web, response times shot up beyond that average, hitting as high as 700 milliseconds. Response times are back around 200 milliseconds midday Wednesday.

This data indicates that "this one is done for" unless the worm has left behind "zombies" -- agents to take over PCs in the future, according to Peter Salus, chief knowledge officer at Matrix.net. Rather than inflicting a major hit on Internet performance, "it looks much more like ... an annoyance," he said. Salus did, however, caution that variants of the worm could arise at any time, with possibly more success or severity.

Not everyone who has been monitoring the worm's outbreak is sure that it has ceased to be a threat.

"As far as we can tell it's still propagating," said Roman Danyliw, an Internet security analyst at the government-funded computer security group CERT/CC (Computer Emergency Response Team/Coordination Center). Nimda is still spreading and is still a threat according to CERT/CC's data, Danyliw said.

Danyliw also warned against the possibility of variants of the worm.

"At any point in the future, variants are very possible," he said.

Even if the spread of Nimda is slowing, the worm still poses a real threat to the Internet because so many systems continue to be unpatched, Danyliw said. Nimda spreads by exploiting security holes in Microsoft Corp.'s Internet Information Server (IIS), Outlook e-mail client and Internet Explorer Web browser. Like the Code Red worm that caused havoc on the Internet in July and August, Nimda exploits vulnerabilities that have long been known and have long had patches available to fix them.

Getting the information about patches and how to apply them to the proper people is a difficult task, Danyliw said, and CERT/CC is "definitely grappling with that problem."

The worm was first identified in the United States around 9 a.m. ET Tuesday. The coincidence of that time and day with last Tuesday's terrorist attacks initially led some to believe that the worm might be part of a cyberattack against the United States. That notion was dispelled by Attorney General John Ashcroft at a news conference held midafternoon Tuesday in which he said there was no reason at the time to believe that the two events were related.

Though Nimda's origin is not yet known, "it's the sort of thing you get from a group of crazed teenagers," not terrorists, according to Matrix.net's Salus. That the worm targeted the newest versions of software from only one vendor indicates that it was not designed as a terrorist tool, he said. The apparent quick end to Nimda's work may drive the worm's writers to create a new worm, or alternately may cause them to lose interest, he said.

The Internet, however, survived Code Red and has, it seems, survived Nimda, as well, Salus said.

"These are nuisances rather than debilitating events," he said.

Join the PC World newsletter!

Error: Please check your email address.

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Sam Costello

Computerworld
Show Comments

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?