Security

Ask something
Discussion Locked

Finding W32/Mimail@MM

0 helpful
2 replies

by michaelh

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I need some advise on how I can locate this virus, I've scanned my entire network using the stinger tool provided by McAfee, patched all systems w/ Microsofts MS02-015 patch, made sure all workstations and servers are clean by running virus scans, manually checked registries, and known files associated to the virus. And I have not had any luck in pinpoint this virus.

I've even deleted the admin email addresses but no luck. Although it poses no threat since the message.zip file attachment is blocked at the server level it's become a huge irritation to those receiving the email

The odd part is it sends an email at exactly 5pm everyday.

Any help is greatly appreciative

2 replies

by angela.brown2

Before it attempts to start its working threads, the worm uses the host name www.google.com (using a 'gethostbyname' call - this returns an IP address corresponding to a given Internet host name) to verify that the machine is connected to the Internet. The worm then searches the local machine to collect e-mail addresses. It searches files in the "C:\Program Files" folder and folders denoted in this registry key:

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

This registry key usually contains the path to the user's Desktop, My Documents and other default folders.

All files are searched except files with these extensions:

COM
WAV
CAB
PDF
RAR
ZIP
TIF
PSD
OCX
VXD
MP3
MPG
AVI
DLL
EXE
GIF
JPG
BMP

The collected e-mail addresses are saved in EML.TMP under Windows directory. The worm then uses its own SMTP engine to email itself to these addresses. The sender account is concocted using "admin" and the recipient's domain name. A set of random characters are added to the subject line to evade SPAM blocking filters.

Additional Information
Although not readily executable, these files that contain the worm might also be created in the Windows directory by the worm to complete its replication routine:

EXE.TMP
ZIP.TMP

Also see link below:
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-014.asp

by jschein

Stinger is an excellent tool. It does not however get rid of the registry settings / possibly some of the additional files.

To remove this virus "by hand", follow these steps:

- Win9x/ME - Reboot the system into Safe Mode (hit the F8 key as soon as the Starting Windows text is displayed, choose Safe Mode.

- WinNT/2K/XP - Terminate the process videodrv.exe

Delete the following files from your WINDOWS directory (typically c:\windows or c:\winnt)
videodrv.exe
eml.tmp
exe.tmp
zip.tmp

Edit the registry
Delete the "VideoDriver" value from
"HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\
CurrentVersion\Run"
"HKEY_CURRENT_USER\Software\Microsoft\Windows\
CurrentVersion\Run"
Delete the key "{11111111-1111-1111-1111-111111111111}" from
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units"
Reboot the system

This discussion is closed to new replies.