Researchers at the Attack Registry and Intelligence Service (ARIS) have found code in the worm that could reactivate Nimda on Thursday evening, 10 days from the start of the original attacks on September 18, according to Oliver Friedrichs, director of engineering at ARIS, which is sponsored by SecurityFocus.
ARIS is not the only virus watchdog group on the lookout for the latest Nimda threat.
"We are keeping an eye on this," said Roger Thompson, technical director of malicious code at TruSecure. "There is definitely some timer code within the worm, but I have not broken it down enough to get a close enough look to see exactly when" it is set to spread again.
