Beware of Nasty Halloween Computer Spam ‘Trick’

By Anastacia Mott Austin

Just when you thought it was safe to check your email….the Storm Worm is back.

Okay, maybe you never think it’s safe, but just in case, computer virus experts warn that the Storm Worm (also known as a trojan) virus is back in a new form.

The emails’ subject lines are "Halloween Fun!" or "The most amazing dancing skeleton!"

If the attachments or bogus links are opened, the new version of Storm Worm is downloaded onto the user’s computer, effectively turning it into a Halloween-themed zombie computer, or a "zombie bot," controlled by the hacker network that created the worm.

The malware first surfaced in January of 2007 and was dubbed the "Storm Worm" by the Finnish company F-Secure because of its initial subject lines purporting to be about storms in Europe, but new mutations appear all the time, including the most recent Halloween-themed version.

In April of this year one of those mutations appeared, masquerading as zip files designed to protect from viruses, with subject lines like "Virus Detected!" and "Spyware Alert!"

Storm Worm is known by a type of malware called a "Trojan horse," or sometimes just a Trojan. As the name implies, its action is to appear to do one thing while actually performing a different function.

It will often install a "back door" program which is designed to give access to the botnet creators who then use the computer for identity theft scams, denial-of-service attacks (which prevents a site from being available to users, especially if it’s suspected by hackers to be scanning them) or to generate mass spam emails.

The Storm Worm can also install something called a "rootkit," which further enables outside controllers to have access to PCs without being detected.

The reason that Storm Worm has received so much attention is that it employs several unique methods to avoid being detected and dismantled. Most malware makers operate their zombie bots through a central web server, which security officials can simple shut down. But Storm Worm operates through a decentralized, peer-to-peer system similar to those which are used to trade music clips and video files, making it impossible to destroy its central control system.

There is some good news. Many antivirus programs, including McAfee, Symantec, Norman, and Sophos can currently detect Storm Worm, and the worm is not designed to infect some older versions of Windows programs. In addition, Microsoft released a malware-removal tool in September that was finally able to wipe out Storm Worm. But experts caution that Storm Worm’s creators are continually updating and adapting it, so this could change.

In the meantime, it remains good advice to never open unknown email attachments and exercise caution with email in general, update your spyware (through known companies).

If you can, it also helps to marry someone who knows more about computer stuff than you do.