No April Fools'--Storm worm is back; don't click on links in Security http://www.dslreports.com/forum/r20259468 en Sun, 27 Jul 2008 02:18:38 EDT Sun, 27 Jul 2008 02:18:38 EDT Re: No April Fools'--Storm worm is back; don't click on links http://www.dslreports.com/forum/remark,20263635 kpatz : I just block anything that has an IP address URL in it. Sticks these stupid spams where they belong.

This regex pattern does the trick.


--
Windows Vista has detected that your mouse was moved. In order to enhance your user experience, Vista needs to contact Microsoft to re-activate the software. Please make sure you are connected to the Internet, have your credit card handy, then click OK.]]> http://www.dslreports.com/forum/remark,20263635 Tue, 01 Apr 2008 12:46:45 EDT Re: No April Fools'--Storm worm is back; don't click on links http://www.dslreports.com/forum/remark,20263123 anon : For those of us running e-mail servers, here is another variation to add to the filters.

Subject - Happy April Fool's Day.

Body - Gotcha! »92.xxx.86.xx ]]> http://www.dslreports.com/forum/remark,20263123 Tue, 01 Apr 2008 11:17:02 EDT Re: No April Fools'--Storm worm is back; don't click on links http://www.dslreports.com/forum/remark,20260315 kpatz : Guess they're looking for "fools" to join their botnet.

Some of the URLs don't have a trailing slash so if your filter expects this, update your filter...]]> http://www.dslreports.com/forum/remark,20260315 Mon, 31 Mar 2008 20:31:44 EDT No April Fools'--Storm worm is back; don't click on links http://www.dslreports.com/forum/remark,20259468 TK Junk Mail : »www.news.com/8301-10789_3-990688···1_3-0-20
Don't click on that silly April Fools' Day e-mail, says one security expert.

In a blog, Arbor Networks' Jose Nazario reports that within the last 24 hours he's seeing new releases of the Storm worm designed to take advantage of the first day of April. This new spam campaign is a lure to infect new computers that will become part of the larger Storm worm botnet.

The e-mail body is spartan: the words "Doh! April Fools" followed by a numeric URL. If a user clicks on that URL, the default Internet browser will open to a page with a cartoon character. A download is supposed to start within five seconds and, according to the message, "If your download does not start, click here and then press 'Run.'"

The compromised computer will then install the downloaded file as C:\WINDOWS\aromis.exe. Nazario reports that the botnet file opens the firewall using the netsh firewall set command, makes a lot of outbound connections, then listens on a random UDP port.
Forewarned is forearmed. Avoid the temptation to click on the links in those April Fools Day emails. Even if they look like they came from someone you know.
--
My BLOG .. .. Internet News .. .. My Web Page]]> http://www.dslreports.com/forum/remark,20259468 Mon, 31 Mar 2008 17:49:35 EDT