W32/Mimail.J Worm

 Information about the W32/Mimail.J Worm:

W32/Mimail.J is an email worm. This worm is a variant of W32/Mimail.I worm. The characteristics of this worm are similar to W32/Mimail.I worm. The worm spreads through email. The worm has a capability of stealing the credit card information of the infected user.

It arrives with the following subject:

Subject: IMPORTANT *Variable string*

The 'From' email address of the infected email will be Do_Not_Reply@paypal.com.

The body of the infected mail will be:

Dear PayPal member,

We regret to inform you that your account is about to be expired in next five business days. To avoid suspension of your account you have to reactivate it by providing us with your personal information.

To update your personal profile and continue using PayPal services you have to run the attached application to this email. Just run it and follow the instructions.

IMPORTANT! If you ignore this alert, your account will be suspended in next five business days and you will not be able to use PayPal anymore.

Thank you for using PayPal.

The infected mail carries an attachment, www.paypal.com.pif or InfoUpdate.exe.

Upon execution of infected attachment, the worm copies itself as svchost32.exe in the Windows folder. The worm also copies PP.GIF and PP.HTA in root of C: drive. Where the svchost32.exe is a copy of the worm and the other files helps the worm to complete its malicious activity.

The worm modifies registry at the following location to load itself during each startup;

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

In order to steal the credit card information, the worm bluffs the user by displaying a fake "PayPal Secure Application" window requesting the user for his/her credit card number, pin and other secured information. Once the information is completely entered and confirmed, the worm stores all the collected data into PPINFO.SYS. Later on it tries to send this file to a pre-configured list of email addresses.

The worm searches for the email addresses present in the cached internet files of the infected computer. In this process email addresses present in the files with the following extensions are excluded: .zip, .wav, .vxd, .tif, .rar, .psd, .pdf, .ocx, .mpg, .mp3, .jpg, .exe, .dll, .com, .cab, .bmp, .avi. The worm uses its own SMTP engine to mail itself to these email addresses.

This worm first appeared on 17th November 2003.

 Other names of W32/Mimail.J Worm:

This worm is also known as W32.Mimail.J@mm, W32/Mimail-J, W32/Mimail.j@MM