Storm Worm Botnet Computer Virus

The FBI issued a warning today about e-mails that purport to link readers to an article about the "FBI Verses Facebook". The FBI Agent says the link is a virus, part of the Storm Worm botnet (a collection of compromised computers under the remote control of a criminal) that can make readers vulnerable to identify theft -- and make government computers vulnerable to national security threats.

Spammers spreading this virus are preying on Internet users and making their computers an unwitting part of criminal botnet activity. The FBI Agent urge net-citizens to help prevent the spread of botnets by becoming Web-savvy and making sure their computers are not compromised.

The warning was issued by the FBI's Internet Crime Complaint Center, which focuses on cyber crime.

This is how the spam e-mail looks like...

Clicking on the URL (wapdailynews.com) will bring you to this page...

Clicking on the "save it", it will download the 92KB "fbi_facebook.exe".  Executing this file will infect the user's system with malicious code.

Background: FBI or Federal Bureau of Investigation began in 1908 as a federal crime buster, first capturing the public imagination in the 1930s, at the height of the Depression, when the G-men (government men) battled a crime wave that included John Dillinger and Ma Parker. The popular Most Wanted List came in the 1950s.

The Storm botnet or Storm worm botnet is a remotely-controlled network of "zombie" computers (or "botnet") that has been linked by the Storm Worm, a Trojan horse spread through e-mail spam. It have been estimated that by end of 2007 it controls 160,000 infected computers. The Storm botnet was first identified around January 2007, with the Storm worm at one point accounting for 8% of all malware on Microsoft Windows computer. The Storm botnet and worm are so-called because of the storm-related subject lines its infectious e-mail employed initially, such as "230 dead as storm batters Europe."

Domain Name:wapdailynews.com
Record created on 2008/7/26
Registrant:
Rit Bush davidbarrett34@usa.com +1.1019434343
422co inc
54232 po box
New York,NY,US 16112
Registrar: ONLINENIC, INC.
The same character also registered smartnewsradio.com domain name on the same day.  So I guess he was using a stolen credit card.

Apparently, wapdailynews.com was hosted on 67.241.117.75.  Which could be another compromised machine.  Did a whois search, and found that it has on a DSL line subscriber at Herndon, VA, USA.

WARNING: Do not attempt to access wapdailynews.com if you do not have a protected PC.  By the way, this page is documented on a MacBook using FireFox3.