I don't normally forward on virus alerts, but someone over on another FE forum got hit with this, and I know we pretty much all use Ebay/paypal and might see this. I got this warning from my corporation, (we are a computer consulting firm).

W32.Mimail.J Internet Worm

W32.Mimail.J@mm is a mass-mailing worm that attempts to steal personal information. The worm displays a web page that looks like a valid PayPal secure application screen. The fictitious page asks the user to enter their credit card information. A subsequent screen requests personal information such as name, address, date of birth, social security number, driver’s license number, etc. This information is saved and later emailed to several predetermined email addresses. If you receive an unexpected e-mail from an unknown source, delete it.

E-mail characteristics:

From: Do_Not_Reply@paypal.com
Subject: IMPORTANT <random string of characters>
Attachment: InfoUpdate***** -or- www,paypal.com.pif

Message:

Dear PayPal member,

We regret to inform you that your account is about to be expired in next five business days. To avoid suspension of your account you have to reactivate it by providing us with your personal information.

To update your personal profile and continue using PayPal services you have to run the attached application to this email. Just run it and follow the instructions.

IMPORTANT! If you ignore this alert, your account will be suspended in next five business days and you will not be able to use PayPal anymore.

Thank you for using PayPal.

Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows XP

Systems Not Affected: DOS, Linux, Macintosh, OS/2, UNIX, Windows 3.x

Payload/Damage:

Large scale e-mailing: Mass-mails itself to addresses found in IE browser cache
Releases confidential info: Captures text from specific windows and sends the data to predetermined email addresses

If your home computer becomes infected, details on how to remove this virus may be found at the following hyperlink:

http://securityresponse.symantec.com...mail.j@mm.html

 

I received a similar email claiming to be from Ebay a few months ago. Same "account is out of date, needs updating" garbage. I forwarded it to their fraud folks and they were right on it.