W32/Mimail-V

Please follow the instructions for removing worms.

You will also need to edit the following registry entries, if they are present. Please read the warning about editing the registry.

At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

and remove any reference to any file you deleted.

Each user has a registry area named HKEY_USERS\[code number indicating user]\. For each user locate the entry:

HKU\[code number]\Software\Microsoft\Windows\
CurrentVersion\Run\

and remove any reference to any file you deleted.

Close the registry editor and reboot your computer.

W32/Mimail-V is a Windows worm that spreads via email and filesharing
networks. W32/Mimail-V also has a backdoor component that allows a malicious user remote access to an infected computer.

In order to run automatically when Windows starts up W32/Mimail-V copies itself
to the Windows system folder using a random filename and creates registry
entries pointing to this file under the following keys:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

W32/Mimail-V also creates the log file xxxx.txt in the folder from which it
was run.

The worm attempts to copy itself to the following folders of popular P2P
applications:

C:\Program Files\WinMX\Shared\
C:\Program Files\Tesla\Files\
C:\Program Files\LimeWire\Shared\
C:\Program Files\Morpheus\My Shared Folder\
C:\Program Files\eMule\Incoming\
C:\Program Files\eDonkey2000\Incoming\
C:\Program Files\Bearshare\Shared\
C:\Program Files\Grokster\My Grokster\
C:\Program Files\ICQ\Shared Folder\
C:\Program Files\Kazaa Lite K++\My Shared Folder\
C:\Program Files\Kazaa Lite\My Shared Folder\
C:\Program Files\Kazaa\My Shared Folder\

When copying itself the worm uses the following filenames:

Microsoft Office 2004 downloader.exe
WinRar 2004.exe
WinZip 2004.exe
WinRar 3.30.exe
All Windows Service Packs.exe
Windows 2003 all service packs.exe
Zone Alarm 2004 firewall.exe
Kaspersky Anti-Hacker 2004.exe
Kaspersky Antivirus 2004 downloader.exe
World Trade Center Photos.exe
World Trade Center.exe
Website Hacker.exe
Keylogger.exe
AOL Password Cracker.exe
ICQ Hacker.exe
AOL Instant Messenger (AIM) Hacker.exe
MSN Password Cracker.exe
Microsoft Windows KeyGen.exe
Microsoft Office KeyGen.exe
Outlook Password Cracker.exe
Windows 9x_nt_xp_2k Password Hacker.exe
Last Exploits.exe
Serials collection 2004.exe
ICQ Cracker.exe
Hotmail Cracker.exe
Hotmail Hacker.exe
Yahoo Hacker.exe
Yahoo Cracker.exe
FTP Cracker.exe
Password Cracker.exe
Windows 2003 full downloader.exe
Email Cracker.exe
Windows Longhorn downloader.exe
Last Porn Collection.exeAll stars porn collection.exe
2004 Child Porn.exe
Britney Spears mp3.exe
Britney Naked.exe
Britney Porn.exe
Britney Spears.exe

W32/Mimail-V also spreads via email. The subject lines and message texts
are constructed randomly from the following building blocks.

Subject Line:

Re:|Re[2]:
your|important|very important request|file|document|bill|payment options|payment details|details| account details|info|information successfully changed|corrected|modified

Message Text:
hi|hellothere.|!|,
|

|
this important|very important text|word|excel|ms word|ms excel|microsoft word|microsoft excel|html file|document|message|files|documents|messages cannot|could not|couldn't be represented|delivered|interpreted as plain|simple|pure text|message and|, that's why|, thats why|and i have sent|i've sent|we have sent|we've sent|our administrator has sent| my network administrator has sent it|
this file|this document|this message as binary|archived|compressed
file|attachment|message.|!

The attachment is either an HTML file containing the embedded worm binary
or a ZIP file containing the HTML page. In the latter case the HTML file has the FOLDER extension which results in it being displayed by explorer or WinZip as a subfolder. When the user clicks on the icon to enter the folder the worm is dropped and executed.

The worm collects email addresses by scanning files on the system.

W32/Mimail-V attempts to terminate running processes of anti-virus and
monitoring programs as well as of other worms such as W32/Bagle.

W32/Mimail-V has functionality to hide its process id and therefore will not
appear in the process list.

When run W32/Mimail-V attempts to connect to a remote IRC server and join a
channel via which a malicious user can control a compromized computer.

W32/Mimail-V also listens on port 6667 and waits for a URL string pointing to a
file which the worm then downloads and executes.