Fraudulent e-mail messages containing the Mytob viruses are causing students added trouble on WebMail.

A harmful computer virus hit Penn State's WebMail server for the second time this year and is attempting to steal personal information by using false sender identifications and threatening students into opening attachments, said John Corro of Penn State Security of Operations and Services.

Corro said that infecting the system and e-mailing copies of itself to available addresses and scanning other systems for vulnerability are primary objectives for the virus.

Mytob will find and use any e-mail address on the hard drive, including individuals and corporations in "trash" and "replied" folders. It then adapts to the users' server code -- in this case psu.edu -- and sends mass copies of the virus, Corro said.

Ludwig said the virus was initially a source of amusement for its creators but has recently turned into a business. She said the person who created the virus, who is not affiliated with Penn State, is now looking to make money.

Ludwig said Mytob will find any data saved into the hard drive, including passwords and user IDs. Users that repeat passwords for numerous accounts increase their computer's vulnerability because that allows the virus to log into all accounts to buy or sell anything to make money, Ludwig said.

"Identity gets stolen," he said.

To prevent virus access, computer owners should look for signs of fraud, like bad grammar and implied threats. Contact information for the sender is also a way to verify that senders are legitimate, Corro said.

Any e-mail message of importance from a Penn State official will include detailed contact information, particularly a phone number, and will never claim to suspend or shut down anything immediately, Corro said.

Once infected by Mytob it is suggested to make back up files, wipe the hard drive clean and re-install all programs, Corro said. Removal tools will not be able detect hidden viruses and rarely get rid of the cause.

"Removal tools leave the payroll on the computer," Corro said. "The user is sharing with someone else completely unknown."

Rebuilding the system usually takes about a day but could take longer for someone unfamiliar with this kind of procedure, Corro said.

Information Technology Services is capable of watching the behavior of all computers on campus and tries to detect most of the cases. Systems found with the virus are immediately shut down. Students whose systems have been terminated have the responsibility to rebuild the system or contact ResCom for full assistance, Ludwig said.

"ITS hopes to make students aware of the virus," Corro said. "We have to take down one to protect the other 500."