Alias:W32/Mimail.c@mm [McAfee], WORM_MIMAIL.C [Trend], W32/Mimail-C [Sophos], I-Worm.Mimail.c [Kaspersky], Win32.Mimail.C [Computer Associates]
Type:Worm 
Size:12,832 Bytes 
Origin: 
Date:00-00-0000 
Damage:Sent by email. 
VDF Version:6.23.00.00 
Danger:Medium 
Distribution:High 

DistributionThe worm uses its own SMTP engine for email spreading. The email contains:

From: %A href="mailto:james@james@%recepient" target="domain"%

Subject: Re[2]: our private photos

Body: Hello Dear!, Finally i've found possibility to right u, my lovely girl :) All our photos which i've made at the beach (even when u're without ur bh:)) photos are great! This evening i'll come and we'll make the best SEX :) Right now enjoy the photos. Kiss, James.

Attachment: photos.zip

Technical DetailsWorm/Mimail.C2 copies itself as %WinDIR%\Netwatch.exe.
It makes the registry entry:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "NetWatch32" = "%WinDIR%\netwatch.exe"

The worm collects email addresses from files, excluding the following types:
com wav cab pdf rar zip tif psd ocx vxd mp3 mpg avi dll exe gif jpg bmp. It saves all email addresses in the file %WinDIR%\eml.tmp.

The worm checks for a valid Internet connection and tries to load www.google.com.

It creates two files in %WinDIR%:
Zip.tmp: A temporary copy of message.zip (12,958 bytes).
Exe.tmp: A temporary copy of message.html (12,832 bytes).
Описание добавил Crony Walker в(о) вторник, 15 июня 2004 г.

Назад . . . .
 
 
 
 

© 2012 Avira Operations GmbH & Co. KG. Все права защищены.