CASE.EDU:    HOME | DIRECTORIES | SEARCH

case western reserve university

INFORMATION SECURITY

 
 

Storm Worm Variants

August 21, 2007

A new variant of the Storm Worm has hit today- with seemingly interesting changes including a userID and password sent to the end user. The worm seems to be 'repacking' itself regularly, so to beat the AV signatures.

An example:
Greetings,

We are so happy you joined Resume Hunters.

Account Number: 618772451
Temp Login ID: user4382
Temp Password ID: pc570

Be Secure. Change your Login ID and Password.

Click on the secure link or paste it to your browser: http://xxx.xxx.xxx.xxx/

Thank You,
Membership Services
Resume Hunters

These have been spamming .edu's and users are advised to delete immediately. Don't be fooled into infecting your machines.

Posted by Thomas Siu at 09:31 AM

Powered by
Movable Type

Site Last Updated: Friday December 17, 2004 at 17:55:51