A new Internet worm that arrives in e-mail entitled "our private photos" is reported to be spreading fast. The worm, a variant of the Mimail worm, has been in the wild since Friday.
Anti-virus software vendors report that the new variant, MiMail.C, arrives in an e-mail that spoofs the recipient`s own domain name. The e-mail appears to have come from someone named James at the recipient`s own company.
The mail carries an attached .zip archive file called "photos.zip". Once opened, the worm harvests e-mails from the user`s PC to mail copies of itself to additional recipients. It also captures information from applications the user has open and mails them to addresses within the malicious code.
The worm also attempts to launch a denial of service attack on Web sites at darkprofits.com and darkprofits.net, the vendors say.
Netxactics, local distributor for Sophos PLC, says it has been receiving reports of MiMail.C and another new variant, MiMail.F, since Friday afternoon.
"People were caught a bit by surprise because of the speed at which the worm spreads, and because it spoofs the recipient`s own domain name in the sender line," says Netxactics CEO Brett Myroff.
"The spread and impact of these viruses is just going to get worse, until companies stop seeing anti-virus as a grudge purchase. They are prepared to spend millions on firewalls, but are reluctant to spend as much on essential anti-virus software," says Myroff.
Idefense says a spike in activity is expected today, as users go back to work after the weekend. The company says the Mimail worm family has had well over 500 000 interceptions in the wild over the past few months.
Share
