The Nimda virus is a malicious file-infecting computer worm. It quickly spread, surpassing the economic damage^{[citation needed]} caused by previous outbreaks such as Code Red.

The first released advisory about this thread (worm) was released on September 18, 2001.^[3] Due to the release date, exactly one week after the attacks on the World Trade Center and Pentagon, some media quickly began speculating a link between the virus and Al Qaeda, though this theory ended up proving unfounded.^{[citation needed]}

Nimda affected both user workstations (clients) running Windows 95, 98, NT, 2000, or XP and servers running Windows NT and 2000.^[3]

The worm's name comes from the reversed spelling of "admin".^{[citation needed]}

F-Secure found the text "Concept Virus(CV) V.5, Copyright(C)2001 R.P.China" in the Nimda code, suggesting its country of origin. However, they also noted that a computer in Canada was responsible for an October 11, 2001 release of infected emails alleging to be from Mikko Hyppönen and Data Fellows (F-Secure's previous name).^[4]

Methods of infection

Nimda proved effective partially because it—unlike other infamous malware like Code Red—uses five different infection vectors:

• Email
• Open network shares
• Browsing of compromised web sites
• Exploitation of various Internet Information Services (IIS) 4.0 / 5.0 directory traversal vulnerabilities. (Both Code Red and Nimda were hugely successful exploiting well known and long solved vulnerabilities in the Microsoft IIS Server.^[5])
• Back doors left behind by the "Code Red II" and "sadmind/IIS" worms.^[6]