Comments on: No April Fools'--Storm worm is back

New spam campaign takes advantage of April Fools' Day in an effort to to infect more computers to become part of the larger Storm worm botnet.

[Lee in San Diego]

Is this because

Is this as a result of the MacBook Air getting pawned within two
minutes last week?

[jumpjetta]

I hope you're being facetious...

...Because the exploit is clearly a WIndows-based one... note the
.EXE?

[3rdalbum]

Don't worry

Don't worry, I'm sure Storm will be ported to Mac OS X soon, when it gets more marketshare than Linux.

[webdev511]

No it's because...

people haven't learned NOT to click on these things, nor have they run an update on their firewall, browsers or anti-malware for um..ever.

[TF_kj]

pretty funny -- real reasons

Now that's pretty funny, Lee. But webdev511 is pretty close to the real reasons why this Storm gang's effort continues: users are fun-seekers and curious and don't always understand what they are getting into when visiting sites and running unknown content on their system.
The Storm malware creators also have gone to great lengths to include effective social engineering techniques in their campaigns to get their code running on users' systems. They spent a large amount of effort on developing and implementing effective av evasion techniques in their packers and changing code base. And traditional signature based solutions have not necessarily kept up with the extreme pace of change of this malware. There are some security solutions specifically targeted by this new storm variant that get clobbered by it.
Once a part of the botnet, the user's compromised system translates into cash for the attackers.

http://blog.threatfire.com

[thetopnerd]

ClickaNerd | Rootkit Virus Removal Tip

If you are infected by this worm and you have some experience in virus removal, we have documented a page to assist you with the quick removal of this worm. Go to This URL: http://www.clickanerd.com/techtips/tips/001-virus-removal.htm

If you have a Google account, please provide some feedback at our blog after you use this page.