A new version of the Mimail email worm is purporting to come from PayPal with the subject header “PAYPAL.COM NEW YEAR OFFER”. Rather than containing the well detected Mimail.P worm, the attachment actually contains a 2kb downloader which if run, promptly toddles off and downloads a copy of Mimail.P from a Russian web server.
Read the full story at The Register