dcsimg
 

New Windows Worm on the Move

By Dennis Fisher  |  Print this article Print
 
 
 
 
 
 
 

WEBINAR:
On-Demand

Re-Imagining Linux Platforms to Meet the Needs of Cloud Service Providers


The Mimail.C mass-mailing worm—which bites Windows systems—is programmed to launch a denial-of-service attack against two domain names.

Antivirus experts are warning of a new mass-mailing worm infecting Windows machines that also is programmed to launch a denial-of-service attack against two domain names. The new pest is called Mimail.C, and it conforms to just about every convention of the mass-mailing virus rulebook.

The worm first appeared Friday morning and is spreading somewhat slowly at this point, although it has the potential to infect a large number of PCs, experts say. Mimail.C arrives via e-mail and has a subject line of: "Re[2]: our private photos." The sender's name is spoofed and often appears to come from the same domain as the recipient. The body of the message reads as follows:

Hello Dear!,

Finally i've found possibility to right u, my lovely girl :)
All our photos which i've made at the beach (even when u're without ur
bh:))
photos are great! This evening i'll come and we'll make the best SEX :)

Right now enjoy the photos.
Kiss, James.
(plus some random characters)

Attachment:
photos.zip

The zipped attachment contains the infected file. Once it executes, the worm mails copies of itself to all of the addresses in the user's Outlook address book and other locations on the hard drive. It also copies itself to the Windows directory as Netwatch.exe, according to an analysis of the worm by Symantec Corp., based in Cupertino, Calif. Mimail.C also makes repeated checks of some specific application windows, looking for sensitive information. Anything it finds is copied to a file it creates called C:\TMPE.TMP and then sent to two e-mail addresses that are found in the worm's code.

The worm is also capable of directing a DoS attack against www.darkprofits.com and www.darkprofits.net.

 
 
 
 
 
 
 
 
 
























By submitting your information, you agree that channelinsider.com may send you channelinsider offers via email, phone and text message, as well as email offers about other products and services that channelinsider believes may be of interest to you. channelinsider will process your information in accordance with the Quinstreet Privacy Policy.

 
 
 
 
 
 

Submit a Comment

Loading Comments...
























By submitting your information, you agree that channelinsider.com may send you channelinsider offers via email, phone and text message, as well as email offers about other products and services that channelinsider believes may be of interest to you. channelinsider will process your information in accordance with the Quinstreet Privacy Policy.

 
 
 
 
 
 
 
 
 
Thanks for your registration, follow us on our social networks to keep up-to-date