Tweet
just been sent this
Mimail.J spreads via e-mail in a message with the subject IMPORTANT and an attached file called w w w.paypal.com.pif. This worm uses so-called social engineering techniques to trick users and spread to as many computer as possible, like the I variant, the message carrying Mimail.J refers to the PAYPAL payment system.When it is run, this malicious code shows an image on screen that simulates the home window of a financial entity. Then, Mimail.J collects the information entered by the user and sends it out via e-mail. In computers with Windows Me/98/95 installed, it runs as a service so that it does not appear in the Task Manager.Mimail.J looks for e-mail addresses in all the files that do not have any of the following extensions: COM, WAV, CAB, PDF, RAR, ZIP, TIF, PSD, OCX, VXD, MP3, MPG, AVI, DLL, EXE, GIF, JPG and BMP, and saves them in a file called el388.tmp. This malicious code then sends itself out to all the addresses it has found, using its own SMTP engine, and connects to the IP address 212.5.86.163, which belongs to a Russian e-mail server.
Mimail.J spreads via e-mail in a message with the subject IMPORTANT and an attached file called w w w.paypal.com.pif. This worm uses so-called social engineering techniques to trick users and spread to as many computer as possible, like the I variant, the message carrying Mimail.J refers to the PAYPAL payment system.When it is run, this malicious code shows an image on screen that simulates the home window of a financial entity. Then, Mimail.J collects the information entered by the user and sends it out via e-mail. In computers with Windows Me/98/95 installed, it runs as a service so that it does not appear in the Task Manager.Mimail.J looks for e-mail addresses in all the files that do not have any of the following extensions: COM, WAV, CAB, PDF, RAR, ZIP, TIF, PSD, OCX, VXD, MP3, MPG, AVI, DLL, EXE, GIF, JPG and BMP, and saves them in a file called el388.tmp. This malicious code then sends itself out to all the addresses it has found, using its own SMTP engine, and connects to the IP address 212.5.86.163, which belongs to a Russian e-mail server.
Comment