‘Nimda fix’ Trojan disguised as security bulletin

Original URL: https://www.theregister.com/2001/10/02/nimda_fix_trojan_disguised_as/

Don't be fooled: .exe bad; .com good

Posted in Security, 2nd October 2001 01:20 GMT

An e-mail message claiming to come from the SecurityFocus ARIS Analyst Team and TrendMicro is being used to deliver what appears to be a Trojan horse to unsuspecting users.

Do not run this attachment. These messages do not come from TrendMicro or SecurityFocus, as a quick check of the headers will reveal.

The e-mail message comes with an executable attachment named FIX_NIMDA.exe. The name is similar to the one used by TrendMicro for their free Nimda removal tool (FIX_NIMDA.com).

Last night, SecurityFocus sent e-mails to its global distribution list to alert users of the fakery. Below is a link to an example of the false e-mail, as well as the recommended patch.

SecurityFocus will never send executable attachments claiming to be a fix to any worm or vulnerability. If you have received a similar message we would like to hear from you.

Common sense and best practices indicates that you should not execute any code that is delivered via email unless you can authenticate the source of the message.

A link to the message is given in the Incidents Mailing List Archive
here.