w32/mimail.i@mm Last Updated 11/14/03 10:45AM

CIT has been notified there is a new email virus in the wild called w32/mimail.i@mm.

In email form, w32/mimail.i@mm appears as follows:

The From"PayPal.com" donotreply@paypal.com

The Subject is:
YOUR PAYPAL.COM ACCOUNT EXPIRES

The Message body is:

Dear PayPal member,

PayPal would like to inform you about some important information regarding your PayPal account. This account, which is associated with the email address will be expiring within five business days. We apologize for any inconvenience that this may cause, but this is occurring because all of our customers are required to update their account settings with their personal information. We are taking these actions because we are implementing a new security policy on our website to insure everyone's absolute privacy. To avoid any interruption in PayPal services then you will need to run the application that we have sent with this email (see attachment) and follow the instructions. Please do not send your personal information through email, as it will not be as secure. IMPORTANT! If you do not update your information with our secure application within the next five business days then we will be forced to deactivate your account and you will not be able to use your PayPal account any longer. It is strongly recommended that you take a few minutes out of your busy day and complete this now. DO NOT REPLY TO THIS MESSAGE VIA EMAIL! This mail is sent by an automated message system and the reply will not be received. Thank you for using PayPal

The attachment is:
www.paypal.com.scr
paypal.asp.scr

NAI has released Dat/SuperDat 4304 to detect and remove w32/mimail.i@mm. The 4304 DAT/SuperDat is now available.

Symantec released new definitions, dated 11/13/03, to detect and remove w32/mimail.i@mm. The definitions are available through the LiveUpdate feature of Symantec Antivirus.

For more information see:

http://vil.nai.com/vil/content/v_100822.htm from NAI.
http://securityresponse.symantec.com/avcenter/venc/data/w32.mimail.i@mm.html from Symantec. Note: Symantec is calling this variant Mimail.H

This archive is not intended to be comprehensive. For a more complete virus library, please visit NAI's Virus Information Library at http://vil.nai.com.