Mimail.T belongs to the Mimail mass-mailing worm family. It was first
found on 5th of February, 2004.
System Infection
When the worm's file is run, it registers itself as a service process and
becomes invisible in Task List on Windows 9x systems.
The the worm copies itself as "kaspersky.exe" file to Windows
directory and creates a startup key for this file in System Registry:
[HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
"KasperskyAv" = "%windir%\kaspersky.exe"
where %windir% is Windows directory name.
Another copy is placed to the Windows Directory with the name 'ee98af.tmp'
which is used later when the worm sends itself in infected emails.
The worm activates the following functions only if it can resolve
'www.google.com' address i.e. when connection to Internet is available.
E-Mail Propagation
When spreading through email this variant of the worm composes e-mail form a
list of text strings within its body.
The name of the attachment is composed as follows, the first part of the
filename is chosen from:
my
priv
private
prv
the
best
super
great
cool
wild
s*x
f*ck
Followed by a second word, form the list:
pic
img
phot
photos
pctrs
images
imgs
scene
plp
act
action
The extension of the attachment if chosen from the following list:
.pif
.scr
.exe
.jpg.scr
.jpg.pif
.jpg.exe
.gif.exe
.gif.pif
.gif.scr
To collect victim's e-mail addresses the worm scans all files on
a hard drive except those with the following extensions:
bmp
jpg
gif
exe
dll
avi
mpg
mp3
vxd
ocx
psd
tif
zip
rar
pdf
cab
wav
com
