Win32:MiMail-A

Win32:MiMail-A

is a worm that spreads via email. It informs the user that his/her email address will expire soon and tries to convince him/her to open and run the attachment.

It comes with the following subject line:
your account [random letters]
The message contains the following text:
Hello there, I would like to inform you about important information
regarding your email address. This email address will be expiring.
Please read attachment for details.
---
Best regards, Administrator

The attached file is message.zip and it is an archive which contains HTML file named Message.htm which contains the executable file and the script to run it.

If executed, the worm copies itself to the following files
C:\Windows\exe.tmp (copy of message.htm)
C:\Windows\zip.tmp (copy of message.zip)
C:\Windows\videodrv.exe

It adds the following key to the registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\VideoDriver =C:\Windows\videodrv.exe

avast! with VPS file dated on or after 2nd August 2003 is able to detect this worm.

Refer: Avast



Copyright © 2004-2004 All rights reserved.
Valid HTML 4.01! Click here to validate current page. Best viewed with ANY browser! Valid CSS! Click here to validate current CSS.