Also known as I-Worm.WatchNet is the latest version of a potent Internet worm that spreads via the Internet in mail attachment named photos.jpg.zip sent via email.
Infected email messages have the following characteristics:
Sender address: james@recipient domain
Subject: Re: our private photos
Body Text: Hello Dear!, Finally i've found possibility to right u, my lovely girl :)
All our photos which i've made at the beach (even when u're without ur bh:))
photos are great! This evening i'll come and we'll make the best SEX :)
Right now enjoy the photos. Kiss, James.
Attachement: photos.jpg.zip (actual name is "photos.jpg.exe")
To mail out infected messages (of itself), it uses its own SMTP engine.
To detect email addresses to target, the worm searches for address strings in files located in the Shell Folders and Program Files directories.
Watches for activity from the e-gold payment system (http://www.e-gold.com) application.
If this application is detected, Mimail.c records some specific data from it in the file c:\tmpe.tmp.
This file is sent out to four email addresses belonging to the worm's author.
Also executes a DDoS attack against the web sitew www.darkprofits.com and www.darkprofits.net by sending to them an endless cycle of packets of random sizes.
Automatic removal: Use antivirus (also check How To Remove section)Startup Optimizer to remove it.