INFO

Claranet have today become aware of a new virus threat, which for
some configurations of customer machines falsely reports to come
from or a similar domain part. The virus is known
as 'Mimail'. Please see the link below for further details -


The virus has the ability to 'spoof' the from field, using any
domain name, and reports that your email address will soon expire.
It advises you to open the attached .zip file, which contains a
.html document that takes advantage of a code exploit to recreate
itself and spread.
*Be advised that you should not open the attachment.*
Customers receiving such mails should note that the issue is a
matter for the network from which the mail originated and not
Claranet. Mails originating from our network should be forwarded to
for investigation. All mails sent from outside the
ClaraNet/FreeUK network should be forwarded to the appropriate
network for investigation.

ALSO
Yeah, funnily enough I was at a customer this afternoon, and they had
the same one, but addressed to (their e-mail host
address) with the same attachment. She said she’d opened it and the
macaffe AV went mad. I downloaded Trojan Remover and ran it in case
there was any infection. Macaffee identified it as a Trojan.

cheers, jrm

ALSO
Yeah, funnily enough I was at a customer this afternoon, and they had
the same one, but addressed to (their e-mail host
address) with the same attachment. She said she'd opened it and the
macaffe AV went mad. I downloaded Trojan Remover and ran it in case
there was any infection. Macaffee identified it as a Trojan.

cheers, jrm

This worm is not ISP specific. See
http://www.internet-magazine.com/news/view.asp?id=3600 for more info.

Howard Neil