W32/Mimail.A Worm

 Information about the W32/Mimail.A worm:

W32/Mimail.A is an email worm. This worm will infect Windows systems. The worm spreads through email.

It arrives with the following subject:

Subject:  your account *Variable string*

The from address of the infected mail will be admin@<domain> The <domain> will be same as the domain present in the email address, to which the infected mail being sent.

The body of the infected mail will be:

I would like to inform you about important information regarding your
email address. This email address will be expiring.
Please read attachment for details.

---
Best regards, Administrator
*Variable string*

The worm uses the same *Variable string* in the subject and the body of the infected mail.

The infected mail carries an attachment message.zip. The zip file contains an html file called Message.htm.

When the infected attachment is executed, it copies Zip.tmp and Exe.tmp files in the Windows folder. After this the worm copies an executable file videodrv.exe in the Windows folder and alters the windows registry to at the following location to load itsellf during next startup;

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

The worm looks for email addresses in all the files except a few file extensions present in the infected system. The worm uses its own SMTP engine to propagate itself to all these addresses.

This worm first appeared on 1st August 2003.

 Other names of W32/Mimail.A worm:

This worm is also known as W32.Mimail.A@mm, WORM_MIMAIL.A, W32/Mimail-A