BleepingComputer.com: MyTob Worm

This week has seen the outbreak of a new worm called the MyTob worm. To Lineone customers the email uses forged lineone.net email addresses to make the email look genuine. Genuine emails sent from Tiscali do not contain attachments. The forged emails typically appear to be sent from admin@lineone.net, info@lineone.net, support@lineone.net or similar and they contain an attachment that you are encouraged to click on. DO NOT click on any such attachment and resist the temptation to even open such suspicious mail if it contains an attachment. Message subjects to be wary of include:

- YOUR EMAIL ACCOUNT IS SUSPENDED FOR SECURITY REASONS
- Account Alert
- Security measures
- Fw: Notice: **Last Warning**
- DETECTED* Online User Violation
- Important Notification
- *WARNING* Your Email Account Will Be Closed

The latest Mytob attacks send out an e-mail message that contains a fake URL pointing to a Web site that hosts the malicious worm code, security company Sophos said Wednesday. Previously, the worm propagated as an attachment in the message itself. Once the worm was downloaded, it installed a backdoor on a PC and used its own e-mail engine to forward itself to addresses gathered from the infected computer.