W32/Mytob-L runs continuously in the background, providing a backdoor server, which allows a remote intruder to gain access and control over the computer via IRC channels. W32/Mytob-L can spread by sending itself as an email attachment to email addresses it harvests from the infected computer.

Emails sent by the worm have the following characteristics:

Subject:
Security measures
Notice: **Last Warning**
*DETECTED* Online User Violation
Your Email Account is Suspended For Security Reasons
Account Alert
Important Notification
*WARNING* Your Email Account Will Be Closed
Email Account Suspension
Notice of account limitation


Body:
Once you have completed the form in the attached file , your account records will not be interrupted and will continue as normal.
The original message has been included as an attachment.
We regret to inform you that your account has been suspended due to the violation of our site policy, more info is attached.
We attached some important information regarding your account.
Please read the attached document and follow its instructions.

More information can be found at this Sophos page.