Nimda worms slows, some see continued spread

Despite a splashy entrance and a comprehensive set of attacks, the Nimda worm that spread quickly across the Internet Tuesday has slowed its pace Wednesday and is no longer substantially affecting network traffic, according to a number of Internet monitoring firms. Not all groups monitoring Nimda's spread, however, are so ready to write it off.

Data from network monitoring companies Inc. and Internet Traffic indicate that while Nimda had a serious effect on the Internet Tuesday, its impact has lessened substantially Wednesday. Nimda caused a drop in availability of about 2.5 percent among the nearly 1,300 Web sites regularly monitors for its data. While these sites are generally about 96 percent available and the average for the week since the terrorist attacks has been about 94 percent, the monitored sites were only about 91 percent to 92 percent available from early Tuesday until early Wednesday.

Internet Traffic's data also bears out Nimda's impact. Among other things, the site measures the average response time of Web servers to requests for information. Over the past week, the average response time has been 223 milliseconds. Beginning Tuesday morning, the time that Nimda appeared on the Web, response times shot up beyond that average, hitting as high as 700 milliseconds. Response times are back around 200 milliseconds midday Wednesday.

This data indicates that "this one is done for" unless the worm has left behind "zombies" -- agents to take over PCs in the future, according to Peter Salus, chief knowledge officer at Rather than inflicting a major hit on Internet performance, "it looks much more like ... an annoyance," he said. Salus did, however, caution that variants of the worm could arise at any time, with possibly more success or severity.

Not everyone who has been monitoring the worm's outbreak is sure that it has ceased to be a threat.

"As far as we can tell it's still propagating," said Roman Danyliw, an Internet security analyst at the government-funded computer security group CERT/CC (Computer Emergency Response Team/Coordination Center). Nimda is still spreading and is still a threat according to CERT/CC's data, Danyliw said.

Danyliw also warned against the possibility of variants of the worm.

"At any point in the future, variants are very possible," he said.

Even if the spread of Nimda is slowing, the worm still poses a real threat to the Internet because so many systems continue to be unpatched, Danyliw said. Nimda spreads by exploiting security holes in Microsoft Corp.'s Internet Information Server (IIS), Outlook e-mail client and Internet Explorer Web browser. Like the Code Red worm that caused havoc on the Internet in July and August, Nimda exploits vulnerabilities that have long been known and have long had patches available to fix them.

Getting the information about patches and how to apply them to the proper people is a difficult task, Danyliw said, and CERT/CC is "definitely grappling with that problem."

The worm was first identified in the United States around 9 a.m. ET Tuesday. The coincidence of that time and day with last Tuesday's terrorist attacks initially led some to believe that the worm might be part of a cyberattack against the United States. That notion was dispelled by Attorney General John Ashcroft at a news conference held midafternoon Tuesday in which he said there was no reason at the time to believe that the two events were related.

Though Nimda's origin is not yet known, "it's the sort of thing you get from a group of crazed teenagers," not terrorists, according to's Salus. That the worm targeted the newest versions of software from only one vendor indicates that it was not designed as a terrorist tool, he said. The apparent quick end to Nimda's work may drive the worm's writers to create a new worm, or alternately may cause them to lose interest, he said.

The Internet, however, survived Code Red and has, it seems, survived Nimda, as well, Salus said.

"These are nuisances rather than debilitating events," he said.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Sam Costello

Show Comments


James Cook University - Master of Data Science Online Course

Learn more >


Victorinox Werks Professional Executive 17 Laptop Case

Learn more >



Back To Business Guide

Click for more ›

Most Popular Reviews

Latest Articles


PCW Evaluation Team

Louise Coady

Brother MFC-L9570CDW Multifunction Printer

The printer was convenient, produced clear and vibrant images and was very easy to use

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?