W32/Mimail.E Worm

 Information about the W32/Mimail.E Worm:

W32/Mimail.E is an email worm. This worm is a variant of W32/Mimail.C worm. The charecteristics of this worm are similar to W32/Mimail.C worm . The worm will infect Windows systems and spreads though email.

It arrives with the following subject:

Subject: don't be late!  *Variable string*

The infected email will display the from as john@<domain>. The displayed will be the domain present in the receiver's email address.

The body of the infected mail will be:

Will meet tonight as we agreed, because on Wednesday I don't think I'll make it,

so don't be late. And yes, by the way here is the file you asked for.
It's all written there. See you.

The infected mail carries an attachment readnow.zip. The zip file contains an executable called readnow.doc.scr

When the infected attachment is unzipped and executed, it copies itself as cnfrm.exe, exe.tmp and zip.tmp in the Windows folder. It alters the windows registry at the following location to load itself during next startup;

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

It also attempts to perform a DOS attack on the following sites:

www.spews.org
www.spamhaus.org
www.spamcop.net
spews.org
spamhaus.org
spamcop.net

The worm searches for email addresses present in the infected system and stores them as eml.tmp under the Windows folder. In this process email addresses present in the files with the following extensions are excluded:
.zip, .wav, .vxd, .tif, .rar, .psd, .pdf, .ocx, .mpg, .mp3, .jpg, .gif, .exe, .dll, .com, .cab, .bmp, .avi.

The worm uses its own SMTP engine to propagate itself to all these addresses.

This worm first appeared on 1st November 2003.

 Other names of W32/Mimail.E Worm:

This worm is also known as I-Worm.Mimail.e, W32/Mimail.e@MM, W32/Mimail-E.