Mimail worm still going strong

The mass-mailing 'mimail' worm, which has bombarded systems over the last three days pretending to be from a user's IT administrator, is still going strong according to security experts.

Mimail broke over the weekend and UK businesses awoke on Monday to find email servers flooded with messages containing the subject line "your account" and signed "Best regards, Administrator", which tried to infect end users by tricking them into opening a .zip attachment containing malicious code.

The worm combines clever social engineering with an exploit for a vulnerability in Internet Explorer that allows a script to be executed by an infected computer. The worm then tries to use that script to spread by mass emailing itself.

Anti-virus firm MessageLabs said it still rates mimail as a 'high-level' threat and has blocked over 76,000 infected messages since the outbreak on 1 August.

Paul Woods, chief information analyst at MessageLabs, said: "It is still quite prevalent at the moment and there is no sign of it slowing down."

He said the worm's ability to spoof the email address of the victim's IT administrator and the use of a .zip attachment are causing problems for businesses.

"Virus writers and spammers are becoming more aware of social engineering techniques and people have to become more aware of the risks."

But Jack Clark, product marketing manager at McAfee, said there are signs that the worm's spread is slowing down.

He said: "We are still seeing activity for mimail but things are tailing off from the weekend's mass proliferation. We have also seen a lot of customers getting clever and blocking .zip files and using desktop firewalls, which can block worms of this sort."