MiMail worm free removal tool

MiMail worm free removal tool A NEW variant of the MiMail worm family, version C, is proliferating across the world, according to security firm iDefense.

MiMail.C has a DDoS component to attack DarkProfits domains and there's likely to be increased activity on Port 80, according to Ken Dunham a security officer at the firm.

He says it's dangerous for corporation, many of which allow people to transfer ZIP files to each other using email.

That means, he says, that MiMail.C "has the upper hand when infiltrating networks configured to allow ZIP attachments".

Symptoms:
Presence of the following file in Windows System directory: SMVC32.EXE

Presence of the following registry key:
HKEY_LOCAL_MACHINESoftwareMicrosoftCurrentVersionRun
with the value:
SMVC = %SYSDIR%SMVC32.EXE

Technical description:
When ran, the worm does the following:

Copies itself to Windows System directory as SMVC32.EXE.
Creates the following registry keys:
- HKLMSoftwareMicrosoftCurrentVersionRunSMVC = %SYSDIR%SMVC32.EXE, so it will be executed every time Windows starts up;
- HKCUSoftwaresocks ;
- HKCUSoftwareserv;
HKCUSoftwarechan;
Connects to an predefined IRC server and listens for commands (such as "execute", shutdown" etc.).
Harvests e-mai addresses from the infected computer, stores them in "c:cyclop.bin" file and periodically sends them to the attacker through e-mail.