Nimda Poison Pill

[Blaine Kubesh <bkubesh () cisco com>]

After disassembling readme.exe and stepping through execution, it is 
possible to make Minda think it is already loaded and quit. 

If a named Mutex is already created with name "fsdhqherwqi2001", the virus 
will exit, preventing activation and further infection. This was tested in 
one configuration and works. I dont see any reason why it would not work 
with the other launch methods.

A quick program can be written to create this mutex, however it needs to be 
re-run after each reboot of the system. It is also important that the mutex 
is created before Minda can activate. This might come in handy for systems 
that cannot be easily patched and are prone to reinfection. 

-BK


----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com