Storm Worm makes April 1 return

[screwballl]

This is not a joke, it started March 31st and continues across Asia today which is already April 2.

DailyTech - Storm Worm Makes April Fools' Return

Storm is back, reports security firm Arbor Networks, and dressed to kill in its April Fools’ outfit.
Arbor Networks blogger Jose Nazario notes that Storm's latest variant began appearing sometime during March 31, greeting users with a simple “Doh! April’s Fool. (sic)” message that hyperlinks to an IP address.
Users clicking the link are taken to a web page with a cute picture and an automatic download, prompting them to run the download as soon as it completes. If the user follows these directions, he or she will find his or her computer added to the decentralized Storm botnet, which security analysts think contains anywhere from 20,000 to 10 million computers.
April Fools’ Day is only the latest such occasion to be exploited by Storm, which in the past has sent out e-mail messages with headlines like, “Saddam Hussein alive!” and “Fidel Castro dead.”
The original Storm variant earned it namesake in January 2007, when it infected thousands of computers in the United States and Europe with the headline “230 dead as storm batters Europe.” Six more waves appeared within three days of the worm’s initial attack, and by January 22 the Storm Worm was responsible for 8% of virus infections around the world.

edit: looking in my yahoo junk mail folder, I got 2 of them...

[Jokerswild]

I never saw it but then again I just deleted over 1000 junk e-mails.

[Zambini]

Good thing google has a "delete all spam messages" button :D

[polobunny]

Couldn't find any trace of it in my spam or in my inbox. I guess I don't have infected friends, or friends for that matter. :(

[Reloadron]

I dumped one from my inbox today:

From: <erdinca@isc.iranet.net>
To: <ME@adelphia.net>
Subject: Happy All Fools Day!
Date: Tuesday, April 01, 2008 9:56 PM
Surprise! The joke's on you. http://xx.xxx.xxx.xx (Removed IP)

--
No virus found in this incoming message.
Checked by AVG.
Version: 7.5.519 / Virus Database: 269.22.4/1355 - Release Date: 4/1/2008 5:37 PM

That may have been one of them. I just delete everything I am unsure of so beats the hell outta me what it was.

Ron

[screwballl]

Tt does not have a virus attached to the email itself. The virus is at the website you click on in the email...

[Reloadron]

Originally Posted by screwballl

Tt does not have a virus attached to the email itself. The virus is at the website you click on in the email...

Yeah, the trick is don't click on the link in the email or bad things will happen. :)

Ron

[screwballl]

even if you click the link, you still have to click Run or Open on the file itself to open it so there is a small bit of reprieve... but most people if they are clicking that to begin with them they will also likely hit Run which of course is how it spreads....
safe computing makes for less chances of doing something dumb like that...


although.... hmmm... maybe I should infect my Windows 2000 VM and see what this virus does exactly....

Looking at more info about it, its whole purpose is just to steal bandwidth as it does not really cause any problems on the computer itself. Other viruses that it may download may cause problems but its whole purpose is just reproduction without damage.

[Jokerswild]

Originally Posted by screwballl

but its whole purpose is just reproduction without damage.

Thats my purpose too.