W32/Mimail.C@mm

This is a virus alert for W32/Mimail.C@mm, a new Mimail
variant, first detected on 31 October 2003.

This worm spreads by e-mail in a ZIP-archive that contains a
file named photos.jpg.exe (some Windows users may see this
file only as photos.jpg). The subject of these e-mails is
"Re[2]: our private photos".

Risk:
Due to its distribution W32/Mimail.C@mm is estimated to be
medium risk.

 

Trend Micro:

As of October 31, 2003 (8:02 AM) US Pacific Time, TrendLabs has declared a YELLOW ALERT to control the spread of WORM_MIMAIL.C. Initial analysis indicates that this memory-resident worm is spreading via SMTP (Simple Mail Transfer Protocol) engine.

Read more:
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_MIMAIL.C

 

Sophos:

http://www.sophos.com/virusinfo/analyses/w32mimailc.html

 

Received two in today's mail - both had attachments. I did not open them as I was suspicious so went to Symantec, typed in the subject line and there it was described as the Mimail.C virus. A friend of mine had her computer infected with this virus so that is probably how it made its way to me.... via her addy book.

 

...FYI...now rated Category 3, Removal Tool available - see the site:

http://securityresponse.symantec.com/avcenter/venc/data/w32.mimail.removal.tool.html

 

Variant D
http://securityresponse.symantec.com/avcenter/venc/data/w32.mimail.d@mm.html

Variant E
http://www.sophos.com/virusinfo/analyses/w32mimaile.html

Mcafee has issued a generic detection for Mimail in their 4301 DAT update.
http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=100796