WinZip Security May Spare Popular Utility From New Worm
The Nimda worm's habit of voraciously infecting executables files on the Windows servers it attacks, yet sparing a popular program known as WinZip, may have a simple explanation, according to anti-virus researchers. Mikko Hypponen, part of a team at Finland-based F-Secure Corp., which dissected the fast-spreading worm this week, told Newsbytes that Nimda's author probably knew better than to allow his creation to tamper with the WinZip program.
Hypponen said WinZip - a file-compression and archiving tool - is known to check its own code on start-up to guard against unauthorized modification. Had Nimda's author allowed the worm to infect the WINZIP32.EXE executable file, the program's refusal to run might have been a tell-tale sign of infection, he speculated.
F-Secure's analysis of Nimda, which appeared dramatically on the Internet radar Tuesday, found that the worm is coded to exclude WinZip when seeking programs to infect while in its "viral" mode. In addition, F-Secure said the worm uses an unusual technique for infecting other executable files.
The researchers found that Nimda tucks the code of the program to be infected within its own body, storing the combined result to the file name used by the legitimate application. When an infected program runs, the viral code launches, does its own malicious business and also extracts for execution a copy of the program that was intended to run.
That's a dramatically different approach than that used by the authors of common intruders - such as Magistr - capable of infecting Windows computers. Rather than wrap themselves around another application, typical viruses are more likely to piggyback on the legitimate software, often modifying program header information that tells the operating system where to find the first bytes of executable code.
What Nimda does have in common with Magistr is its ability to send copies of itself via e-mail. In addition, the versatile Nimda worm can automatically break in to vulnerable Microsoft IIS Web servers after launching Code-Red-like probes across the Internet.
Launched on Web servers, Nimda can infect Web pages in much the same way it infects HTML-formatted e-mail. From servers or workstations, it also can make copies of itself on local area network-connected drives.
F-Secure said that Nimda infects executable files only on servers.
F-Secure is at http://www.fsecure.com .
CERT, a computer security clearing house at Carnegie Mellon University's Software Engineering Institute, maintains a Nimda advisory at http://www.cert.org/advisories/CA-2001-26.html .
