News

Mimail Worm Appears to Come from User's Own Administrator

Anti-virus vendors released a flurry of warnings over the weekend about a new e-mail worm called Mimail that is spreading in the wild. Symantec rated the virus as a 3 on its threat scale, a medium ranking that puts Mimail below only Bugbear on its current list of top virus threats.

Several vendors have published removal tools. Symantec's is available here.

Mimail arrives as an e-mail with "your account" in the subject line and an attachment called message.zip. The message appears to come from the e-mail address "admin" within the user's own domain.

When run, the attachment copies an executable to the hard drive, enters itself into the registry to run at startup and collects e-mail addresses from files all over the computer. It uses its own SMTP server to spread by e-mail, and it captures text from specific windows and sends them to e-mail addresses contained within the worm.

About the Author

Scott Bekker is editor in chief of Redmond Channel Partner magazine.

Featured

  • Microsoft Warns IT Pros on Windows Netlogon Fix Coming Next Month

    Microsoft on Thursday issued a reminder to organizations to ensure that their systems are properly patched for a "Critical"-rated Windows Netlogon vulnerability before next month's "update Tuesday" patch distribution arrives.

  • Microsoft Nudging Skype for Business Users to Teams

    Microsoft on Thursday announced some perks and prods for Skype for Business unified communications users, with the aim of moving them to the Microsoft Teams collaboration service instead.

  • How To Improve Windows 10's Sound and Video Quality

    Windows 10 comes with built-in tools that can help users get the most out of their sound and video hardware.

  • Microsoft Offers More 'Solorigate' Advice Using Microsoft 365 Defender Tools

    Microsoft issued yet another article with advice on how to use its Microsoft 365 Defender suite of tools to protect against "Solorigate" advanced persistent threat types of attacks in a Thursday announcement.

comments powered by Disqus