Mimail mutant maximises Mydoom misery

Double whammy as Mimail.S variant adds to worldwide devastation

Robert Jaques, vnunet.com 30 Jan 2004

The devastation created by the Mydoom virus, which is still spreading, has been compounded by the detection of a previously unknown mutant of the Mimail virus.

One in every five emails currently transmitted is thought to be carrying Mydoom, with four million infected emails thought to be in circulation.

Internet security firm Panda Software said that variant 'S' of Mimail (W32/Mimail.S.worm) is very similar to its prolific predecessors and could not have arrived at a worse time.

"The appearance of these two viruses at the same time means that you can never drop your guard, and that you must be extremely careful with all the email you receive," said Luis Corrons, director of PandaLabs.

Mimail.S uses its own SMTP engine to send itself out to all the addresses it finds on the affected computer in an email with the following characteristics:

Subject: a random combination of the following phrases:

Re:
Re[2]:
Re[3]:/smart,cool,sexy,super/pics,images,pictures,photos,photo, picture/private
only for you
just for you
important
very important

Mimail.S is more dangerous than Mydoom in that it tries to steal the credit card details belonging to the user of the infected computer.

In order to do this, it displays a fake form warning users that their Windows licence has expired, and prompting them to renew it.

This form requests personal information including a credit card number, its expiry date and Pin.

After the user has entered the requested data, Mimail.S checks whether the credit card number is correct and displays an error message if it is not.

Meanwhile, Mydoom.A is now attacking companies without protection that survived the first wave of infected messages.

According to data collected by Panda Software's online antivirus service, Mydoom.A has infected six times more computers than Bugbear.B, the second most prevalent virus it has detected.

Corporate environments around the globe have been hit the hardest by Mydoom.A, and the number of infected computers has reached 400,000, according to Panda.

See also: