Feeds

Dangerous Mimail variant knocks over anti-spam sites

Noxious viral variants plague PC users

  • alert
  • submit to reddit

The Power of One eBook: Top reasons to choose HP BladeSystem

Updated AV vendors are warning of the spread of a dangerous worm, called Mimail-C, which offers racy pictures but delivers only fresh misery for credulous Windows users. Another variant, Mimail-D, which attempts to DDoS anti-spam sites, is also causing considerable Net disruption.

Mimail-C normally spreads through email using its own Simple Mail Transfer Protocol (SMTP) client. Infectious emails typically have subject lines such as "Re[2]: our private photos ???" and a compressed file attachment (photos.zip) which contains an executable file named photos.jpg.exe, as explained in a Trend Micro advisory.

As usual, this is a Windows-only menace - Linux, Mac, OS/2 and Unix users are immune.

Windows users who open the executable file get themselves infected. Thereafter the worm scours the hard disk of infected machines for the email addresses of potential victims. The worm fakes the sender's email address by composing it from 'james@' and the domain name of a recipient.

Mimail-C tries to perform a DoS (Denial of Service) attack on certain sites and to steal information from infected computer users, as explained by Kaspersky Labs here. Most AV vendors rate Mimail-C as medium risk.

Although it's certainly dangerous and spreading, Mimail-C has yet to reach epidemic proportions. According to email filtering firm MessageLabs, the original Mimail-A worm is much more common. This may be explained by the use of certain Windows exploits with Mimail-A that are not featured in Mimail-C or other variants of the worm.

Mimail-C and Mimail-D were both first spotted on Friday (October 31 - Halloween).

Mimail-D attempts to DDoS anti-spam organisations Spamhaus, Spamcop, and SPEWS. Mimail-D has a different subject line (typically "don't be late!") and attachment name (readnow.zip) to Mimail-C, but is otherwise similar.

Mimail-D, which is also (confusingly) called Mimail-E by some AV vendors, is less common, so far, than Mimail-C.

Even so the DDoS attack against Spamhaus created by Mimail-D has made the site almost unreachable today.

Mimail-D is designed to cause infected computers to each begin making overwhelming amounts of bogus requests to Spamhaus.org's web server. The worm also attacks the web servers of spamcop.net and spews.org.

In a statement, Spamhaus said Mimail-D is the "latest in a string of viruses, each one released by spammers for the purpose of creating a vast worldwide zombie network of spam-sending machines and building an attack network consisting of hundreds of thousands of virus-infected zombie machines with which the spammers then attack anti-spam organizations".

Standard defence precautions against viral attacks from all variants of the worm: users should update their AV signature definition files to detect the virus and resist the temptation to open suspicious looking emails. ®

Related Stories

Sneaky virus poses as email from sysadmin (Mimail-A)
Sober email worm gives Windows users the DTs
Joe Average User Is In Trouble
The trouble with anti-virus

Designing a Defense for Mobile Applications

More from The Register

next story
Mozilla fixes CRITICAL security holes in Firefox, urges v31 upgrade
Misc memory hazards 'could be exploited' - and guess what, one's a Javascript vuln
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
Four fake Google haxbots hit YOUR WEBSITE every day
Goog the perfect ruse to slip into SEO orfice
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.