  TK Junk Mail Go ahead, make my day Premium join:2002-03-03 Margate City, NJ clubs:
·Comcast
| No April Fools'--Storm worm is back; don't click on links
»www.news.com/8301-10789_3-990688···1_3-0-20
Don't click on that silly April Fools' Day e-mail, says one security expert.
In a blog, Arbor Networks' Jose Nazario reports that within the last 24 hours he's seeing new releases of the Storm worm designed to take advantage of the first day of April. This new spam campaign is a lure to infect new computers that will become part of the larger Storm worm botnet.
The e-mail body is spartan: the words "Doh! April Fools" followed by a numeric URL. If a user clicks on that URL, the default Internet browser will open to a page with a cartoon character. A download is supposed to start within five seconds and, according to the message, "If your download does not start, click here and then press 'Run.'"
The compromised computer will then install the downloaded file as C:\WINDOWS\aromis.exe. Nazario reports that the botnet file opens the firewall using the netsh firewall set command, makes a lot of outbound connections, then listens on a random UDP port. Forewarned is forearmed. Avoid the temptation to click on the links in those April Fools Day emails. Even if they look like they came from someone you know. -- My BLOG .. .. Internet News .. .. My Web Page |
|
 kpatz Premium join:2003-06-13 Manchester, NH | Guess they're looking for "fools" to join their botnet.
Some of the URLs don't have a trailing slash so if your filter expects this, update your filter... |
|
  Killer Maxx
@rr.com | reply to TK Junk Mail For those of us running e-mail servers, here is another variation to add to the filters.
Subject - Happy April Fool's Day.
Body - Gotcha! »92.xxx.86.xx |
|
 kpatz Premium join:2003-06-13 Manchester, NH
| reply to TK Junk Mail I just block anything that has an IP address URL in it. Sticks these stupid spams where they belong.
This regex pattern does the trick.
-- Windows Vista has detected that your mouse was moved. In order to enhance your user experience, Vista needs to contact Microsoft to re-activate the software. Please make sure you are connected to the Internet, have your credit card handy, then click OK. |
|