W32/Mimail.L Worm

 Information about the W32/Mimail.L Worm:

W32/Mimail.L is an email worm. This worm is a variant of W32/Mimail.C worm. The worm spreads through email.

It arrives with the following subject:

Subject:Re[2] We are going to bill your credit card

The 'From' email address of the infected email may vary within its list;

The body of the infected mail will be either of these:

Body 1:

Hi Greg its Wendy.

I was shocked, when I found out that it wasn't you but your twin brother!!! That's
amazing, you're as like as two peas. No one in bed is better than you Greg. I remember,
I remember everything very well, that promised you to tell how it was, I'll give you a call
today after 9.

... omitted ...

I'm so thankful to you, for acquainted me to your brother. I think we can do it on the next
Saturday all three together? What do you think? O yes, as you wanted I've made a few
pictures check them out in archive, I hope they will excite you, and you will dream of our
new meeting...

Wendy.

Body 2:

Good afternoon, We are going to bill your credit card for amount of $22.95 on a weekly
basis. Free pack of child porn CDs is already on the way to your billing address. If you
want to cancel membership and your CD pack please email order and credit card
details to security@europe.spamhaus.org

Are you ready for all types of underage porn? We have the best selection for every taste!

Just click the secret links below and have fun:
http://www.spamhaus.org
http://www.spews.org
http://www.register.com
http://www.cardcops.com
http://www.carderplanet.net
http://www.spamcop.net
http://disney.go.com
http://www.authorizenet.com/

Nude boys under 16! Nude girls under 16! Incest, a daddy & a daughter! We have
everything you have ever dreamed for!

The infected mail carries an attachment, wendy.zip.

Upon execution of infected attachment, the worm copies itself as svchost.exe in the Windows folder. The worm also copies xu39reu.tmp and x8wui12s.tmp in Windows folder. Where the svchost.exe and xu39reu.tmp are the copies of the worm and the x8wui12s.tmp is one more copy of the worm in the compressed format..

The worm modifies registry at the following location to load itself during each startup;

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

The worm searches for the email addresses present in the infected system and stores them in a file called xu298da.tmp, in the Windows folder. While hunting for email addresses, the worm ignores the files with the following extensions; .zip, .wav, .vxd, .tif, .rar, .psd, .pdf, .ocx, .mpg, .mp3, .jpg, .exe, .dll, .com, .cab, .bmp, .avi. The worm uses its own SMTP engine to mail itself to these email addresses. The worm checks for the internet connectivity by pinging www.register.com.

It also attempts to perform a DDOS attack on the following websites:

www.spews.org
www.spamhaus.org
www.spamcop.net
www.register.com
www.carderplanet.net
www.cardcops.com
www.authorizenet.com
disney.go.com

This worm first appeared on 1st December 2003.

 Other names of W32/Mimail.L Worm:

This worm is also known as W32/Mimail.l@MM, W32.Mimail.L@mm,