The Mimail-A worm, which pretends to be a message from an enterprise e-mail administrator, appears to have peaked.
U.K.-based e-mail filtering outsourcer MessageLabs said it captured 30,000 copies of Mimail at its height on Monday. On Tuesday, the firm said it had trapped 26,000.
Mimail does not exploit the Windows RPC-DCOM vulnerability, as some have feared. It does target vulnerabilities in Internet Explorer and Microsoft Outlook Express known as the Object Tag code base exploit and MHTML exploit.
Attackers exploiting those flaws can run code of their choice on vulnerable machines. The following versions are vulnerable: Microsoft Outlook Express 5.5, Microsoft Outlook Express 6.0, Microsoft Internet Explorer 5.01, Microsoft Internet Explorer 5.5, and Microsoft Internet Explorer 6.0.
Mimail-A began spreading on the Internet on Friday. The worm gained some traction because of its social engineering, which makes it appear to come from the user's e-mail administrator. For example, someone with a SearchSecurity.com e-mail address would get a message from "firstname.lastname@example.org."
While July was a busy month for Microsoft vulnerabilities, it was a fairly slow month for viruses and worms. Few new creepy crawlies made any real traction, but some old ones were still going strong.
In July, variants of Klez, Sobig and Bugbear topped the lists of prolific malicious code from the antivirus software vendors. "What we have seen with
The only worms that made some minor waves were variants of the Gruel worm, a mass mailer that used a variety of social engineering. For instance, some e-mail messages purported to be a patch from Microsoft for a security vulnerability.
Here are a sampling of lists from antivirus software vendors.
Central Command's top 12 list of the most prevalent malware for July:
Panda Software top 10 most detected malware for July:
Sophos' top 10 list for the month: