W32/Mimail.I Worm

 Information about the W32/Mimail.I Worm:

W32/Mimail.I is an email worm. This worm is a variant of W32/Mimail worm. This worm has a capability of stealing the credit card information of the infected user. This worm spreads through email.

It arrives with the following subject:

Subject: YOUR PAYPAL.COM ACCOUNT EXPIRES

The infected email will display the from as "PayPal.com" donotreply@paypal.com.

The body of the infected mail will be:

Dear PayPal member,

PayPal would like to inform you about some important information regarding your PayPal account. This account, which is associated with the email address

<RECIPIENT EMAIL ADDRESS>

will be expiring within five business days. We apologize for any inconvenience that this may cause, but this is occurring because all of our customers are required to update their account settings with their personal information.

We are taking these actions because we are implementing a new security policy on our website to insure everyone's absolute privacy. To avoid any interruption in PayPal services then you will need to run the application that we have sent with this email (see attachment) and follow the instructions. Please do not send your personal information through email, as it will not be as secure.

IMPORTANT! If you do not update your information with our secure application within the next five business days then we will be forced to deactivate your account and you will not be able to use your PayPal account any longer. It is strongly recommended that you take a few minutes out of your busy day and complete this now.

DO NOT REPLY TO THIS MESSAGE VIA EMAIL! This mail is sent by an automated message system and the reply will not be received.

Thank you for using PayPal

The infected mail carries an attachment, paypal.asp.scr or www.paypal.com.scr

Upon execution of infected attachment, the worm copies itself as svchost32.exe in the Windows folder and also it copies as PP.GIF, PP.HTA and PPINFO.SYS in root of C: drive.

Where the svchost32.exe is the copy of the worm and the other files copied in C:\ are the associated files which helps the worm to complete this malicious activity.

The worm modifies registry at the following location to load itself during each startup;

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

In order to steal the credit card information, the worm bluffs the user by displaying a fake "PayPal Secure Application" window where the user is allowed to enter credit card number, pin and other secured information. Once the information is completely entered and confirmed, the worm stores all stolen data into PPINFO.SYS.

The worm searches for email addresses present in the cached internet files of the infected computer. In this process email addresses present in the files with the following extensions are excluded: .zip, .wav, .vxd, .tif, .rar, .psd, .pdf, .ocx, .mpg, .mp3, .jpg, .exe, .dll, .com, .cab, .bmp, .avi. The worm uses its own SMTP engine to mail the information to pre-configured email addresses.

This worm first appeared on 13th November 2003.

 Other names of W32/Mimail.I Worm:

This worm is also known as W32.Paylap@mm, WORM_MIMAIL.I, W32/Mimail-I