Alarming experience: While working at my computer this afternoon, Norton Anti-Virus 2002 suddenly reported that five files containing the Nimda worm were found on my system. Norton killed all of them immediately, but I realized that someone was putting files on my computer through my Internet connection and was doubtlessly still around.
I immediately disconnected and reinstalled Norton Internet Firewall, which I had to remove last week while writing a book (a section on installing software to protect yourself from Internet abuse, no less).
Using the Guest account, the intruder dropped the files in a couple of shared folders I had left open that contained nothing but a few sample JPGs and WMA files that came with XP. I can't make any sense of the names of the files they gave me: dsc00004.eml, dsc00007.nws, einstein.eml, grid.eml and pre school songs.eml. I'm hoping they were sent to me by an automated process, since Nimda can spread via open shares like the one I was briefly offering the world. However, none of the filenames showed up in a Google search, which I would've expected if they were being routinely used to infect new computers. Does Nimda really copy a few randomly selected files into a shared folder hoping that the user will open them at some point and spread the worm?
Adding further insult, I also was sharing my fax machine -- which had some personal information in recent faxes I wouldn't want to share with a script kiddie.
Add a Comment
All comments are moderated before publication. These HTML tags are permitted: <p>, <b>, <i>, <a>, and <blockquote>. This site is protected by reCAPTCHA (for which the Google Privacy Policy and Terms of Service apply).
Social Media
Subscriptions
Blogroll
Projects
Statistics
This blog has been published since Nov. 7, 1999 (a span of 8,927 days).
Thank you for visiting Workbench.
