RE: WORM_MIMAIL.A Anyone have any info on what this does yet?

There is a list of SMTP servers that, once infected, the virus will scan the infected system looking for valid emails, store it in "eml.tmp" C:\windows dir, and once it senses an internet connection will forward itself to everyone in the eml.tmp file via those external SMTP servers. The virus writes the following key to make sure it runs at start up: HKLM\Software\Microsoft\Windows\CurrentVersion\RunVideoDriver=C:=Windows directory\videodrv.exe

Check for:

C:\Windows\videodrv.exe (payload)
C:\Windows\eml.tmp (list of emails the payload found to send itself to)
c:\Windows\foo.exe (installation file)

r/Jim Butterworth

> -----Original Message-----
> From: Jay Woody [SMTP:jay_woody@tnb.com]
> Sent: Friday, August 01, 2003 11:54 AM
> To: incidents@securityfocus.com
> Subject: RE: WORM_MIMAIL.A Anyone have any info on what this does yet?
>
> We are just dropping everything from admin@tnb.com. This message seems