New Year Virus Alert - Storm Worm

Most business have taken necessary steps to protect their systems from computer viruses. Here is one that can be particularly difficult and worth watching out for. It is hitting around now.

The Channel Wire December 27, 2007
Storm Worm Entices With New Year's Spam

By Stefanie Hoffman

The Storm Worm loves the holidays. Security researchers have found that the Storm virus is ringing in the New Year with a fresh wave of attacks. This time, the notorious botnet is recruiting new members with a greeting spam. Subject lines include: "A fresh New Year" "As the New Year..." "As you embrace another New Year" "Blasting New Year" "Happy 2008" "It's the new year" "Joyous new year" "New Hope and New Beginnings" "New Year Ecard" "New Year Postcard" "Opportunities for the New Year" "Happy New Year to You" "Happy New Year to (email address)" "Lots of greetings on the New Year" "New Year Wishes for You."

See more here CRN Blog  or here Symantec Security.

The e-mails then attempt to direct users to a malicious Web site called uhavepostcard.com. A blog post by anti-virus firm F-secure warns that while the site remains free of exploits (for now), the spam will likely be a precurser to a New Year's Eve-themed Storm attack.

Dr. Dobb's reports:

Storm Worm Continues Mutating for Holidays

The Storm worm, which has been plaguing PC users for much of 2007, is not going down without a fight.

The Storm worm, a trojan that has been luring PC users into the Storm botnet for much of 2007, has been resurgent this holiday season. Since Monday, the worm has been sending Christmas-themed spam designed to lure new victims into downloading the malicious executable from MerryChristmasdude dot com (address mangled for safety).

In just the last day, the worm has switched to sending New Year's-themed spam. The worm has been using some sophisticated techniques to avoid detection and thwart anti-virus efforts. It has been repacking itself every few minutes to fool signature-based anti-virus software. The New Year's spam is now directing users' systems to download malicious code from Uhavepostcard dot com, a site kept viable by a fast-flux DNS technique that hides it behind an ever-changing series of proxy machines.