Name : Netwatch.exe
Path : %WINDOWS%\netwatch.exe
[ C:\Windows\netwatch.exe ]
type : Internet
Alias : I-Worm/Mimail.C,
W32/Mimail-C, W32/Mimail.c@mm, WORM_MIMAIL.C, I-Worm.NetWatch
level : Low
Netwatch.exe is dropped
by mimail.C worm. It is a
modified variant of Mimail
worm. It collects e-mail addresses stored in the
local hard disk to distribute infected messages. Mimail.C worm arrives as
an e-mail attachment. The infected attachment
name will be "photos.zip". The
infected mail sample is given below.
Subject: Re: our private photos <random
Finally i've found possibility to right u, my
lovely girl :)
All our photos which i've made at the beach (even
when u're without ur bh:))
photos are great! This evening i'll come and we'll
make the best SEX :)
Right now enjoy the photos.
When the worm file photos.jpg.exe
stored in phots.zip is executed, it copies
itself to netwatch.exe in Windows folder.
It also drops Zip.tmp, exe.tmp in Windows folder.
Mimail.C collects e-mail
addresses in the local system and stores it in a
file eml.tmp. After checking the Internet
connection, Mimail.C sends infected messages to
all the e-mail addresses stored in eml.tmp. The
worm uses its own SMTP engine to send infected
Mimail modifies registry
run section to load automatically on the next
startup. The registry modification is given below.
Mimail.C variant performs
denial of service (DoS) attack on darkprofits.com,
darkprofits.net, www.darkprofits.com, and www.darkprofits.net.
The worm contains backdoor abilities and it can
be used to steal the data stored in the infected
system. Mimail.C variant appeared on 31st October
How can I protect my
Solo has incorporated
netwatch.exe in its signature file to protect
users from this Worm attack. Solo antivirus
registered users are already protected from this
Worm. Make sure that you have installed
registered version of Solo Antivirus to protect
your system from all virus threats.
to remove this Worm?
you are already infected with netwatch.exe process,
you can remove it from your computer using Solo
Antivirus software. Use the
following link to Download 30 day trial
version of Solo antivirus to remove
viruses from your computer.
Solo anti-virus not only
scans for all viruses, it contains a unique System
Integrity Checker to protect you from
New Internet Worms, Backdoors and
malicious VB, Java Scripts. It also
effectively removes all existing Internet Worms,
File viruses, malicious VB, Java scripts, Trojans,
Backdoors, boot sector, partition table and macro
purchase Solo antivirus using the link