No April Fools'--Storm worm is back
(Credit:
Jose Nazario, Arbor Networks)
Don't click on that silly April Fools' Day e-mail, says one security expert.
In a blog, Arbor Networks' Jose Nazario reports that within the last 24 hours he's seeing new releases of the Storm worm designed to take advantage of the first day of April. This new spam campaign is a lure to infect new computers that will become part of the larger Storm worm botnet.
The e-mail body is spartan: the words "Doh! April Fools" followed by a numeric URL. If a user clicks on that URL, the default Internet browser will open to a page with a cartoon character. A download is supposed to start within five seconds and, according to the message, "If your download does not start, click here and then press 'Run.'"
The compromised computer will then install the downloaded file as C:\WINDOWS\aromis.exe. Nazario reports that the botnet file opens the firewall using the netsh firewall set command, makes a lot of outbound connections, then listens on a random UDP port.
As CNET's resident security expert, Robert Vamosi has been interviewed on the BBC, CNN, MSNBC, and other outlets to share his knowledge about the latest online threats and to offer advice on personal and corporate security. Listen to his podcast at securitybites.cnet.com or e-mail Robert with your questions and comments. 
minutes last week?
.EXE?
The Storm malware creators also have gone to great lengths to include effective social engineering techniques in their campaigns to get their code running on users' systems. They spent a large amount of effort on developing and implementing effective av evasion techniques in their packers and changing code base. And traditional signature based solutions have not necessarily kept up with the extreme pace of change of this malware. There are some security solutions specifically targeted by this new storm variant that get clobbered by it.
Once a part of the botnet, the user's compromised system translates into cash for the attackers.
http://blog.threatfire.com
- ClickaNerd | Rootkit Virus Removal Tip
- by thetopnerd April 1, 2008 8:27 PM PDT
- If you are infected by this worm and you have some experience in virus removal, we have documented a page to assist you with the quick removal of this worm. Go to This URL: http://www.clickanerd.com/techtips/tips/001-virus-removal.htm
- Like this Reply to this comment
-
(9 Comments)If you have a Google account, please provide some feedback at our blog after you use this page.