W32/Mimail.T Worm

 Information about the W32/Mimail.T Worm:

W32/Mimail.T is a mass mailing worm. This worm is a variant of W32/Mimail worm. The worm spreads through email.

It arrives with the following subject;

Re:Gollum

The body of the infected mail will be random text chosen by the worm.

Example:

Hi Gollum its Nancy.

I was shocked, when I found out that it wasn't you but your twin brother, that's amazing, you're as like as two peas. No one in bed is better than you Gollum. I remember, I remember everything very well, that promised you to tell how it was, I'll give you a call today after 9. He took my skirt off, then my panties, then my bra, he sucked my tits, with the same fury you do it. He was writing alphabet on my pussy for 20 minutes, then suddenly stopped, put me in doggy style position and stuck his dagger. But Gollum, why didn't you warn me that his dick is 15 inches long? I was struck, we fucked whole night. I'm so thankful to you, for acquainted me to your brother. I think we can do it on the next Saturday all three together? What do you think? O yes, as you wanted I've made a few pictures check them out in archive, I hope they will excite you, and you will dream of our new meeting...

It carries an infected attachment fail.hta, a password protected .zip format file, which contains a file test.exe.

Upon execution of the attachment, the worm copies itself as kaspersky.exe and ee98af.tmp in the Windows folder.

It also alters the windows registry at the following location to load itself during next startup;

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

To propagate itself, the worm searches for the email addresses present in the infected computer. In this process email addresses present in the files with the following extensions are excluded: .mpg, .avi, .dll, .bmp, .com, .wav, .exe, .gif, .jpg, .cab, .pdf, .rar, .zip, .tif, .psd, .ocx, .vxd, .mp3 and store those email addresses in Outlook.cfg in the Windows folder. The worm uses its own SMTP engine to mail itself to these email addresses.

The worm also regularly tries to connect to "www.google.com", inorder to check the internet connectivity.

This worm first appeared on 5th February, 2004.

 Other names of W32/Mimail.T Worm:

This Worm is also known as W32/Mimail.T@MM, W32.Mimail-T, WORM_MIMAIL.T, Win32.Mimail.T.