Spammers send Wendy after anti-spammers

Opening the attached Zip file unleashes a malevolent worm that seeks to launch denial of service attacks on spambusting outfits SpamHaus, Spamcop and others. The worm, W32/Mimail-L, spreads via email using addresses harvested from the hard drive of the infected computer, according to anti-virus company Sophos.

If the initial mail fails, the worm sends another which contains the text:
Good afternoon, We are going to bill your credit card for amount of $22.95 on a weekly basis. Free pack of child porn CDs is already on the way to your billing address. If you want to cancel membership and your CD pack please email order and credit card details to security@europe.spamhaus.org

Sheesh!

It's the third time Spamhaus has been targeted by a mimail variant and they're sick of it. The site says its been inundated with complaints from folk who believe the organisation has ordered the child porn CDs on their behalf and are currently cooperating with the police to further their inquiries.

"As a distributer Denial of Service (dDoS) attack, MiMail.L was not very strong," Spamhaus spokesman Steve Linford told The INQUIRER. "Our web site servers have been able to stand up to it well, however our servers are well-prepared to handle dDoS attacks as we've been under almost constant dDoS attacks by spammers since July.

"What was different with MiMail.L," he said, "was that in addition to it carrying out a dDoS attack on us, the virus also claimed to come from "billing@spamhaus.org" and it's text was designed to inflame as many people as possible to get people to bomb us with complaints.

Spamhaus reckons 60 per cent of all email traffic is now spam and that this will increase to 70 per cent over the coming month. µ

L'INQ
Sophos
Spamhaus Project

UPDATED
18:10, 03/12/03