More Worms

Watch out for Mimail.L. During 1st and 2nd December 2003, MessageLabs has intercepted a number of copies of a further variant of the Mimail email worm – W32/Mimail.L. 
 
Here’s what to watch out for:
The worm arrives as an attachment to an email with the subject line Re[2]. The emails arrive from spoofed addresses, disguising the true identity of the sender, such as:
billing.authorizenet.com
billing.spamcop.net
billing.carderplanet.net
billing.cardcops.com
billing.register.com
billing.spews.org
billing.spamhaus.org
 
The worm is self-propagating, and spreads by sending itself to emails harvested from infected machines.
 
Email characteristics
 
Subject line: Re[2]
Possible message texts:
Hi Greg its Wendy.
I was shocked, when I found out that it wasn’t you but your twin brother!!! That’s amazing, you’re as like as two peas. No one in bed is better than you Greg. I remember, I remember everything very well, that promised you to tell how it was, I’ll give you a call today after 9.
 
(remainder of text removed)
 

03. December 2003 by jeremy
Categories: Malware | Tags: , | Comments Off on More Worms