said by Aladdin newsletter:

---

====================================================
Aladdin Content Security Response Team - Virus Alert
====================================================

Win32.Mytob.eg
===========================

Virus/Vandal name: Win32.Mytob.eg
Threat Level: Medium
Alias: WORM_MYTOB.EG, Net-Worm.Win32.Mytob.au, W32/Mytob-AU
Platforms: Win 95, Win 98, Win ME, Win NT, Win 2K, Win XP
Updated on: May 10, 2005
Arrival Form: Email
Type: Win32, Worm, Trojan
Damage: Create files, Modify files, Send Email, Remote control, Lowers
security

Introduction
---------------------
Win32.Mytob.eg is a mass-mailing worm which opens a backdoor on infected
systems and terminates security-related processes.

The arriving email will have the following characteristics:

Subject: The subject of this mail will be one of the following:

*IMPORTANT* Please Validate Your Email Account
*IMPORTANT* Your Account Has Been Locked
[random text string]
Email Account Suspension
Notice: **Last Warning**
Notice:***Your email account will be suspended***
Security measures
Your email account access is restricted
Your Email Account is Suspended For Security Reasons

Body: The body of this mail will be one of the following:

[random text string]

Account Information Are Attached!

Once you have completed the form in the attached file , your account
records will not be interrupted and will continue as normal.

please look at attached document.

To safeguard your email account from possible termination, please see the
attached file.

To unblock your email account acces, please see the attachement.

We have suspended some of your email services, to resolve the problem you
should read the attached document.

Attached File: The attached file will have one of the following names:

[random text string]
document_full
email-doc
email-info
email-text
IMPORTANT
information
info-text
your_details

followed by one of the following extensions:

bat
cmd
exe
pif
scr
zip

Malicious Activity
--------------------------
When the worm is executed it does the following:

1. It drops a copy of itself, internet.exe, into the default Windows
System folder.

2. To run on every startup, the worm creates the following registry entry:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
Internet Services = 'internet.exe'

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
Internet Services = 'internet.exe'

3. When it runs on an up-to-date version of Windows XP, the worm will
disable the firewall by modifying the following registry entry:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SharedAccess
Start = '4'

4. The worm is also capable of connecting to an IRC server and listening
to incoming commands coming from a specific channel. This may allow a
hacker to take over the infected system.

5. The worm then terminates several security-related processes and also
blocks access to such websites to prevent security updates.

6. Finally, the worm will harvest email addresses from the infected system
and send itself to most contacts found. Some addresses may be avoided by
the worm.

eSafe Users
---------------------
eSafe users are protected against this vandal using the latest
vandal/virus update.

---

quote:

---

Account and Password Information are attached!

Visit: http: //www.lacoe.edu

*** AntiVirus: No Virus found
*** "$MY_DOMAIN" Anti-Virus
*** http: //www.$MY_DOMAIN.com

Attachment: account_info.zip

---

said by »news.com.com/Sober+worm+spreads+···bj=news:

---

Sober.P, first detected on Monday, now accounts for 77 percent of all viruses detected by Sophos's threat-monitoring stations worldwide, the British security company said on Tuesday. At the same time, Kaspersky Lab, a Russian maker of antivirus software designed to combat such threats, described the worm's spread in Western Europe as an "epidemic."

---

said by Symantec Security Response:

---

Initial analysis indicates the worm may arrive as an email attachment named account_info-text.zip, mail_info.zip, or our_secret.zip. The zip file contains the worm executable as the file Winzipped-Text_Data.txt, with a double extension of .exe or .pif.

---