|
|
I-Worm.Mimail. Viruses Information
| Name: |
I-Worm.Mimail. |
| Category: |
Viruses |
| Description:
|
Details
I-Worm.Mimail.i
Mimail.i spreads through the Internet in the infected file attachment paypal.asp.scr. The Mimial.i worm is a Windows application file (PE EXE file) that is about 12 KB in size and compressed by UPX. The uncompressed size is about 30KB.
Infected email messages include the following content:
Sender address:
donotreply@paypal.com
Subject:
YOUR PAYPAL.COM ACCOUNT EXPIRES
Body Text:
Dear PayPal member,
PayPal would like to inform you about some important information regarding your PayPal account. This account, which is associated with this email address will be expiring within five business days. We apologize for any inconvenience that this may cause, but this is occurring because all of our customers are required to update their account settings with their personal information.
We are taking these actions because we are implementing a new security policy on our website to insure everyone's absolute privacy. To avoid any interruption in PayPal services then you will need to run the application that we have sent with this email (see attachment) and follow the instructions. Please do not send your personal information through email, as it will not be as secure.
IMPORTANT! If you do not update your information with our secure application within the next five business days then we will be forced to deactivate your account and you will not be able to use your PayPal account any longer. It is strongly recommended that you take a few minutes out of your busy day and complete this now.
DO NOT REPLY TO THIS MESSAGE VIA EMAIL! This mail is sent by an automated message system and the reply will not be received.
Thank you for using PayPal.
Attachement:
paypal.asp.scr
The Mimail.i worm only gains control if a victim opens the file attachment.
Behaviour
Upon being launched the Mimail.i worm displays a dialogue window asking the computer user to supply PayPal credit card data. Any data entered is then kept in the file named ppinfo.sys, which is then sent to the evildoer behind the worm (the worm's author).
Mimail.i then copies itself into the Windows catalogue under the name svchost32.exe and registers itself in the system registry auto-run key with the following entry:
HKLMSoftwareMicrosoftWindowsCurrentVersionRun
SvcHost32 = %windir%svchost32.exe
Mimail.i creates two files in the C: root directory - pp.gif and pp.hta. These files are used to display the dialogue window requesting PayPal credit card information.
The worm creates the following files in the Windows directory:
zp3891.tmp
ee98af.tmp
el388.tmp
Spreading
To mail out infected messages (of itself), Mimail.c uses its own SMTP engine. To detect email addresses to target, the worm searches for address strings contained in files located in the Shell Folders and Program Files directories. |
Top Viruses Visited Pages:
Invader. - 241 visits
not-a-virus:RiskWare.Tool.RegPatch. - 73 visits
Worm.P2P.Harex. - 67 visits
not-a-virus:RemoteAdmin.Win32.RAdmin.2 - 60 visits
Small.58. - 56 visits
Coito.64 - 54 visits
I-Worm.Mapson. - 48 visits
Win32.Hidra - 43 visits
Win16.Klon.1177 - 42 visits
Marine.500 - 35 visits
Random Viruses Pages:
HDKille
Macro.Word.KillDo
I-Worm.Plexus.
Macro.Word.Fl
Macro.Word.Alie
Win95.Marburg.
Macro.Word97.Breede
I-Worm.Updater.
Shire Famil
Beavis.65
|
|
