mark2 Posted August 2, 2003 Report Share Posted August 2, 2003 A new worm is now in the wild, AVG, Mcafee and Avast have all released updates to detect it.Name: W32.Mimail.A@mm (Symantec)Aliases: Worm_Mimail.A (Trend)Type: WormPlatforms: Windows 32-bitStatus: In the WildThreat: Medium (V-CON 3)The following has been derived from information provided by Trend, SymantecVirus Characteristics=====================Upon execution, W32.Mimail.A@mm, drops a copy of itself as VIDEODRV.EXE inthe Windows directory.It creates the following registry entries so that it is executed at everyWindows startup: HKEY_Local_Machine\Software\Microsoft\Windows\CurrentVersion\Run " VideoDriver "=" %Windows% \videodrv.exe "W32.Mimail.A@mm, propagates via email, with the following characteristics:Subject: "your account %n%"Body: "Hello there, I would like to inform you about important informationregarding your email address. This email address will be expiring. Please read attachment for details. Best regards, Administrator"Attachment: "message.zip"(Note: %n% is a variable string.)It arrives as an HTML attachment which contains a Win32 EXE file. When theHTML file is opened, it takes advantage of an Internet Explorer securitysystem vulnerability that can allow a script to execute on the Localcomputer. See the following link for more information:http://www.microsoft.com/technet/treeview/...url=/technet/se curity/bulletin/MS02-015.aspThe exploit code then launches the .EXE file containing the worm program.The worm component uses the following SMTP servers to send email to targetaddresses:acm.orgmirc.commx2.daemonmail.netiglou.comft.comwinamp.commail.winamp.comsmtp.ceruleanstudios.comceruleanstudios.comIt also tries a list of usernames to connect to the above SMTP servers.Preventative Measures=====================Block messages which have an attachment named "messages.zip" or similarmessage body at the Internet gateway where possible.Fixes Available===============Network Associates: Minimum DAT: 4282 Release Date: 08/01/2003 Minimum Engine: 4.1.60Symantec: Virus Definitions (Intelligent Updater): 8/1/2003 Virus Definitions (LiveUpdate): 8/1/2003Trend: Pattern File: 597Avast 0307-5might be a good idea to check you have the latest updates for your own A/V :ph34r: Quote Link to comment Share on other sites More sharing options...
Guest LB Posted August 2, 2003 Report Share Posted August 2, 2003 what sort of sick people write these things???i simply do not understand their motivation....ps thanks for the heads up mark Quote Link to comment Share on other sites More sharing options...
mark2 Posted August 2, 2003 Author Report Share Posted August 2, 2003 LB your sig might give us a clue perhaps they're insane genius's :D do you do any programming :lol: :lol: :lol: Quote Link to comment Share on other sites More sharing options...
Redhat Posted August 2, 2003 Report Share Posted August 2, 2003 Their 'motivation' is a rather pathetic aim to become '133t' and impress all their IRC buddies ;) Death to script kiddies, losers. Quote Link to comment Share on other sites More sharing options...
Guest LB Posted August 2, 2003 Report Share Posted August 2, 2003 LB your sig might give us a clue perhaps they're insane genius's :D do you do any programming :lol: :lol: :lol:in college (all those years ago) my tutor told me that i would be better at debugging than actually writing programs (we were taught PASCAL back then!!!!), i also did a logic test when i worked for Rank Xerox as i really wanted to work in their networking department....i failed miserably and was consigned to the scrapheap........incidentally, the signature was taken from a flag seen at anfield....... Quote Link to comment Share on other sites More sharing options...
monkey Posted August 2, 2003 Report Share Posted August 2, 2003 i hate people that send worms and trogens <----(i think that is how you spell it) thats why i want a kick back wall if some one sends you any thing i changes all the direction and all of that and sends it back to the person who sent it ha ha ha ha ha ha i so want one MONKEY Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.