Feeds

Dangerous Mimail variant knocks over anti-spam sites

Noxious viral variants plague PC users

  • alert
  • submit to reddit

Securing Web Applications Made Simple and Scalable

Updated AV vendors are warning of the spread of a dangerous worm, called Mimail-C, which offers racy pictures but delivers only fresh misery for credulous Windows users. Another variant, Mimail-D, which attempts to DDoS anti-spam sites, is also causing considerable Net disruption.

Mimail-C normally spreads through email using its own Simple Mail Transfer Protocol (SMTP) client. Infectious emails typically have subject lines such as "Re[2]: our private photos ???" and a compressed file attachment (photos.zip) which contains an executable file named photos.jpg.exe, as explained in a Trend Micro advisory.

As usual, this is a Windows-only menace - Linux, Mac, OS/2 and Unix users are immune.

Windows users who open the executable file get themselves infected. Thereafter the worm scours the hard disk of infected machines for the email addresses of potential victims. The worm fakes the sender's email address by composing it from 'james@' and the domain name of a recipient.

Mimail-C tries to perform a DoS (Denial of Service) attack on certain sites and to steal information from infected computer users, as explained by Kaspersky Labs here. Most AV vendors rate Mimail-C as medium risk.

Although it's certainly dangerous and spreading, Mimail-C has yet to reach epidemic proportions. According to email filtering firm MessageLabs, the original Mimail-A worm is much more common. This may be explained by the use of certain Windows exploits with Mimail-A that are not featured in Mimail-C or other variants of the worm.

Mimail-C and Mimail-D were both first spotted on Friday (October 31 - Halloween).

Mimail-D attempts to DDoS anti-spam organisations Spamhaus, Spamcop, and SPEWS. Mimail-D has a different subject line (typically "don't be late!") and attachment name (readnow.zip) to Mimail-C, but is otherwise similar.

Mimail-D, which is also (confusingly) called Mimail-E by some AV vendors, is less common, so far, than Mimail-C.

Even so the DDoS attack against Spamhaus created by Mimail-D has made the site almost unreachable today.

Mimail-D is designed to cause infected computers to each begin making overwhelming amounts of bogus requests to Spamhaus.org's web server. The worm also attacks the web servers of spamcop.net and spews.org.

In a statement, Spamhaus said Mimail-D is the "latest in a string of viruses, each one released by spammers for the purpose of creating a vast worldwide zombie network of spam-sending machines and building an attack network consisting of hundreds of thousands of virus-infected zombie machines with which the spammers then attack anti-spam organizations".

Standard defence precautions against viral attacks from all variants of the worm: users should update their AV signature definition files to detect the virus and resist the temptation to open suspicious looking emails. ®

Related Stories

Sneaky virus poses as email from sysadmin (Mimail-A)
Sober email worm gives Windows users the DTs
Joe Average User Is In Trouble
The trouble with anti-virus

Mobile application security vulnerability report

More from The Register

next story
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
NEW, SINISTER web tracking tech fingerprints your computer by making it draw
Have you on YouPorn lately, perhaps? White House website?
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
NUDE SNAPS AGENCY: NSA bods love 'showing off your saucy selfies'
Swapping other people's sexts is a fringe benefit, says Snowden
Own a Cisco modem or wireless gateway? It might be owned by someone else, too
Remote code exec in HTTP server hands kit to bad guys
British data cops: We need greater powers and more money
You want data butt kicking, we need bigger boots - ICO
prev story

Whitepapers

Reducing security risks from open source software
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.