One of the sneakiest viruses to date began spreading rapidly across the Internet this weekend.

Mimail, which poses as an email from a potential victim's own sysadmin or ISP, suggests that a user's email account is about to expire.

Potential victims are urge to open an attachment message.zip, containing a copy of the virus.

Users who unzip the file find another innocent-looking HTML file inside, named 'message.html'.

This file contains an embedded EXE file, when opened in vulnerable versions of Internet Explorer, will drop an executable named foo.exe and run it. More information on the IE MHTML vulnerability used here can be found in an April 2003 advisory by Microsoft.


rest of story