W32.Mimail.J@mm

Due to a decreased rate of submissions, Symantec Security Response has downgraded this threat to a Category 2 rating as of January 6, 2004.

W32.Mimail.J@mm is a mass-mailing worm that attempts to steal personal information. This worm displays a series of forms that ask users to enter their credit card information. (See the "Technical Details" for illustrations.) This information is saved and later emailed to several predetermined email addresses.

This worm is similar to W32.Mimail.I@mm.

The email has the following characteristics:

From: Do_Not_Reply@paypal.com
Subject: IMPORTANT  <random string of characters>
Attachment: InfoUpdate.exe -or-
www.paypal.com.pif

---

Note: Virus definitions dated November 17, 2003, rev 21 (20031117.021), or greater are required to detect this threat.

---

Antivirus Protection Dates

• Initial Rapid Release version November 17, 2003
• Latest Rapid Release version July 19, 2008 revision 019
• Initial Daily Certified version November 17, 2003
• Latest Daily Certified version January 20, 2009 revision 048
• Initial Weekly Certified release date November 17, 2003

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

• Wild Level: Low
• Number of Infections: More than 1000
• Number of Sites: More than 10
• Geographical Distribution: Medium
• Threat Containment: Easy
• Removal: Moderate

Damage

• Damage Level: Medium

Distribution

• Distribution Level: High