[Full-disclosure] New Variant of the Storm Virus

[eflorio at edmaster.it (eflorio)]

The web-component of the new StormWorm variant is distributed by the following domains:
mailfreepostcards.com
postcardsbargain.com
2007postcards.com
ecolorpostcards.com
bestnetpostcards.com
freewebpostcards.com

They all resolve to 209.123.8.198 at the moment.
The remote page could be "funvideo.html", "clip.html" or "winner.html".

More info here:
http://www.symantec.com/enterprise/security_response/weblog/2007/02/mespam_infecting_web_20_with_l.html


EF

----- Original Message -----
From: gerald.m.davis
[mailto:gerald.m.davis at verizonbusiness.com]
To:
full-disclosure at lists.grok.org.uk, 'WASC Forum'
[mailto:websecurity at webappsec.org]
Sent: Wed, 28 Feb 2007 21:40:49
+0100
Subject: [Full-disclosure] New Variant of the Storm Virus


> Was just reading an article about a new variant or what is believe to be a
> varient of the Storm Virus and am trying to find out more information about
> it in order to put appropriate IP/Domain blocks and counter messures in
> place. 
> 
> Specifically I am looking to determing the Domain(s)and IP address to block
> as well as possible obtaining a copy of the code to reverse engineer.
> 
> If anyone has more information on this I would appreciate the feedback. 
> 
> Article of interest:
> http://www.networkworld.com/news/2007/022707-storm-virus-blogs.html?nlhtsec=
> 0226securityalert3&company=SonicWall
> 
> 
> Thanks,
> Gerry
> 
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>