Email-Worm:W32/Mimail.T

System Infection

When the worm's file is run, it registers itself as a service process and becomes invisible in Task List on Windows 9x systems.

The the worm copies itself as "kaspersky.exe" file to Windows directory and creates a startup key for this file in System Registry:

[HKLM\Software\Microsoft\Windows\CurrentVersion\Run] "KasperskyAv" = "%windir%\kaspersky.exe"

where %windir% is Windows directory name.

Another copy is placed to the Windows Directory with the name 'ee98af.tmp' which is used later when the worm sends itself in infected emails.

The worm activates the following functions only if it can resolve 'www.google.com' address i.e. when connection to Internet is available.

email Propagation

When spreading through email this variant of the worm composes email form a list of text strings within its body.

The name of the attachment is composed as follows, the first part of the filename is chosen from:

my priv private prv the best super great cool wild s*x f*ck

Followed by a second word, form the list:

pic img phot photos pctrs images imgs scene plp act action

The extension of the attachment if chosen from the following list:

.pif .scr .exe .jpg.scr .jpg.pif .jpg.exe .gif.exe .gif.pif .gif.scr

To collect victim's email addresses the worm scans all files on a hard drive except those with the following extensions:

bmp jpg gif exe dll avi mpg mp3 vxd ocx psd tif zip rar pdf cab wav com

The collected email addresses are saved into "outlook.cfg" file located in Windows folder.

To send emails the worm tries to contact the recipient's SMTP server directly. For this purpose it tries to resolve the current user's DNS server and search for SMTP server info for recipient's domain.