|I-Worm.Mimail.g is a variant of I.Worm.Mimail.e.
This worm spreads via the Internet being attached to infected emails.
Infected mails contain the following:
Sender's address: john@recipient domain
Message header: don't be late!
Message body: Will meet tonight as we agreed, because on Wednesday I don't think I'll make it, so don't be late. And yes, by the way here is the file you asked for. It's all written there. See you.
The attached file contains the worm under the name 'readnow.doc.scr'
This version of the worm does not contain the function which enables it to steal E-Gold users' information.
The worm carries out a DoS attack on the site mysupersales.com in the same way that I-Worm Mimail.c does.
Please, go to the key in the system registry: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
and delete the value: "SystemLoad32" = "%windir\sysload32.exe"