W32/Mimail.C Worm

 Information about the W32/Mimail.C Worm:

W32/Mimail.C is an email worm. This worm is a variant of W32/Mimail.A worm. This worm will infect Windows systems. This worm spreads through email.

It arrives with the following subject:

Subject: Re[2]: our private photos *Variable string*

The infected email will display the from as james@<domain>. The displayed will be the domain present in the receiver's email address.

The body of the infected mail will be:

Finaly i've found possibility to right u, my lovely girl :)
All our photos which i've made at the beach (even when u're without ur bh:))
photos are great! This evening i'll come and we'll make the best SEX :)

Right now enjoy the photos.

Kiss, James.

The infected mail carries an attachment, photos.zip. The zip file contains an executable called photos.jpg.exe.

When the infected attachment is unzipped and executed, it copies itself as netwatch.exe in the Windows folder and alters the windows registry at the following location to load itself during next startup;

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

It also attempts to perform a DOS attack on the following sites www.darkprofits.com, www.darkprofits.net, darkprofits.com and darkprofits.net.
The worm looks for email addresses present in the infected system and stores as them eml.tmp under the Windows folder. The worm uses its own SMTP engine to propagate itself to all these addresses.

This worm first appeared on 31st October 2003.


 Other names of W32/Mimail.C Worm:

This worm is also known as I-Worm.NetWatch, W32/Bics@mm, W32/Mimail.C@mm.