Mytob worm family spreads rapidly.

According to SophosLabs the Mytob worms currently accounts for more than half of the top twenty viruses reported to Sophos in the last 48 hours, representing 42.9% of all virus reports.

One of the most widespread variants--Mytob-CM--was first seen on Friday, 27 May. Like many of its family members, Mytob-CM spreads via email in an infected attachment. It purports to warn users of security or account issues in its subject line, such as' *DETECTED* Online User Violation', 'Your Email Account is Suspended For Security Reasons and 'Account AlerV. When the infected attachment is launched, Mytob-CM attempts to turn off security applications and deny access to many popular security websites. It also attempts to open a backdoor onto the computer, allowing unauthorised and remote users to access the system.

The creators of Mytob, a combination of source codes from previous threats MyDoom and Rbot, appear to be a group of virus writers called HeUbot. Having more than one writer may aid them in issuing several different variants in short time periods.

"The Mytob source codes suggest that the virus writers are following a carefully planned stxategy, whereby the routine allows the virus to develop," continued Theriault. "By issuing many threats, all of which are tweaked slightly differently, they may be searching for the elements of their malicious code that will help them create a super worm.'

Sophos recommends companies protect their email with a consolidated solution to thwart the virus and spam threats and secure their desktops and servers with automatically updated anti-virus protection.

www.sophos.com