Mimail Worm

                     I-Worm/Mimail is a mass mailing worm, spreads through e-mail addresses collected from infected machines hard disk. Mimail arrives as an e-mail attachment with the following subject and message body.

From: admin@domain-name
Subject: your account <random characters>
Attachment: Message.zip

Hello there,

I would like to inform you about important information regarding your
email address. This email address will be expiring.
Please read attachment for details.

---
Best regards, Administrator
<random characters>

                     Mimail uses security hole in Internet explorer to infect.  You can find more details about this vulnerability and security patch download details at http://www.microsoft.com/technet/security/bulletin/MS02-015.asp. You can install Internet Explorer 6.0 to close this security hole.

                     When the worm file message.html  is executed, it copies itself to Temporary Internet Files folder as "Foo.exe" and runs it. It drops videodrv.exe in the infected system. Mimail modifies registry run section to load automatically on the next startup. 

Remvoing Mimail from your computer:

                     Fire has incorporated I-Worm/Mimail worm in its signature file to protect Fire users from this worm attack. Fire anti-virus users can update this signature file by using online update facility. It is available with the registered version of Fire anti-virus Kit. If you are already infected with this worm, run Fire anti-virus and choose delete option to remove the worm components.

                     A free download of FireLite [ 1100 KB ] version is also available to detect other viruses including Mimail Worm. Fire anti-virus kit removes Mimail worm safely. To get the registered version of Fire call us at 044-28170440 or mail to service@fireav.com or purchase Fire online using

[Analysis: Mr. Jacob Kalis, Prognet Technologies Pvt. Ltd, Aug. 2003]