By David Becker, 3 November 2003 09:15
NEWS Security experts are warning of a potentially harmful new email worm that is slowly spreading among corporate and home email users.
The Mimail.c worm, a variant of an earlier pest that achieved modest distribution by posing as a message from a company's information technology staff, was first detected late last week and managed to infect a handful of PCs.
But Craig Schmugar, a virus research engineer at security company McAfee's Antivirus Emergency Response Team, said the worm's spread already appeared to be ebbing. "At this point, it looks like we're probably past the worst of it," he said.
According to McAfee's description, Mimail.c spreads by email, appearing in mailboxes as a message with the subject "our private photos". The body of the message promises revealing photos, if the recipient opens up an attached file saved in the Zip compression format. If the file is opened, the worm attempts to spread itself by sending messages to email addresses culled from the infected PC.
The worm also attempts to launch a denial-of-service attack by sending large volumes of "garbage data" to web addresses associated with DarkProfits, a gaming enthusiast site that has been the subject of a persistent email hoax.
Schmugar said one of the more unusual aspects of the worm - which McAfee classified as a "moderate" threat - was its use of a Zip file, which could prove to have longer legs than the .exe files most worms try to spread.
"A lot of enterprises have rules to block executable attachments, so using the Zip format could let them penetrate into the corporate environment a little further," he said. "That's why you still need good antivirus protection on the desktop."
Mimail.c also spoofs the address the message is generated from, with all messages appearing to come from "James" at the same domain as the recipient.
David Becker writes for CNET News.com
Comments
There are 4 comments. Join the discussion
1. Lawrence Elliott
yes this virus arrived today on my pc, lucky that I was sceptical and did not open it. I phoned a colleague who is a system administrator for confirmation. What gets me is the fact that I use McAfee Anti Virus and Firewall and have all the current updates(religously done regular)...so how did this get through? These so called large companies should be more vigilant and responsible instead of blowing their own trumpets on how good they are. I am very disappointed with McAfee especially after reading the above article.
2. anonymous
I am currently receiving these emails. What can i do to stop them apart from blocking the address?
3. anonymous
If you don't have selected scan compressed files it could have gotton throught this way.
4. anonymous
Block not only the address but also the subject line, zip files...
Get a decent antivirus product