| MiMail.E is a mass mailing worm that arrives as a zipped attachment in an email. The zip file contains a virus.The virus arrives as an email similar to: |
From: john@<current domain> (The from
address may be spoofed to appear that it is coming from the current
domain)
Subject: don't be late!
Message:
Hello Dear!,
Will meet tonight as we agreed, because on Wednesday I don't think I'll
make it,
so don't be late. And yes, by the way here is the file you asked for.
It's all written there. See you.
Attachment: readnow.zip
(which contains readnow.doc.scr)
How Does MiMail.E Worm Infect My System?
Once unzipped, it creates a file named sysload32.exe in the Windows directory and adds the following registry key to the system.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ Run
"SystemLoad32" = C:\Windows\sysload32.exe
What Does the MiMail.E Worm Do?
Once a computer is infected, the virus checks to see if the system is connected to the Internet by trying to contact google.com. If it can contact google, then the worm attempts to gather email addresses from the infected computer. It grabs addresses from all files on the system, EXCEPT files that have the following extensions:
- COM
- WAV
- CAB
- RAR
- ZIP
- TIF
- PSD
- OCX
- VXD
- MP3
- MPG
- AVI
- DLL
- EXE
- GIF
- JPG
- BMP
These addresses are then stored in a file named eml.tmp in the Windows directory. The worm has its own SMTP engine. For each email address the worms sends, it will
- Look up the MX record for the domain name using the DNS server of the current host. If a DNS server is not found, it will default to 212.5.86.163
- Acquire the mail server associated with that particular domain.
- Directly contact the destination server.
It will also try to perform a denial of service attack on the following domains:
- mysupersales.com
- www.mysupersales.com
How Can I Remove the MiMail.E worm?
Follow these steps in removing the MiMail.E worm.
1) Terminate the running program
- Open the Windows Task Manager by either pressing CTRL+ALT+DEL on Win9x machines or CTL+Shift+Tab and clicking on the Processes tab on WinNT/2000/XP machines.
- Locate the following program, click on it and End Task or End Process
SystemLoad32
- Close Task Manager
2) Remove the Registry entries
- Click on Start, Run, Regedit
- In the left panel go to
HKEY_LOCAL_MACHINE>Software>Microsoft>Windows>Current Version>Run
- In the right panel, right-click and delete the following entry
"SystemLoad32" = C:\Windows\sysload32.exe
- Close the Registry Editor
3) Delete the infected files (for Windows ME and XP remember to turn off System Restore before searching for and deleting these files to remove infected backed up files as well)
- Click
Start, point to Find or Search, and then click Files or Folders.
- Make
sure that "Look in" is set to (C:\WINDOWS).
- In the
"Named" or "Search for..." box, type, or copy and paste, the file
names: (these are all in the Windows directory)
sysload32.exe
eml.tmp
zip.tmp
exe.tmp
- Click
Find Now or Search Now.
- Delete the displayed files.
4) Reboot the computer and run a thorough virus scan using your favorite antivirus program.
For Automatic Removal of MiMail.E, download the Symantec removal tool
Other Variations of this virus
Mimail.A Worm Removal
Instructions
Mimail.C Worm
Removal Instructions
MiMail.D Worm
Removal Instructions
MiMail.F Worm
Removal Instructions
MiMail.G Worm
Removal Instructions
MiMail.I and
MiMail.J Worm Removal Instructions
Tools for Removing Spyware, Adware, and Malware
PC HELL
Other Pages
Welchia (Dllhost.exe and SVCHost.exe) Worm Removal
Uninstall Antivir Instructions
How to Manually Run the Microsoft Malicious Software Removal Tool
Bloodhound.Exploit.6 Virus Removal
Backdoor SDBot.H Trojan Removal
