MessageLabs said that the botnet had been reduced to just five per cent of its size in April, but rival security firm Symantec has since claimed that the Storm worm is "still evolving".

Symantec's Vikram Thakur said that there has been activity in domains related to Storm, where apparently blank web pages have been registered in the past few days.

However, if you visit one of these pages and slightly alter the URL, the web page attempts to install malicious code on your PC. The code tries to exploit flaws in Internet Explorer and RealPlayer.

Thakur said that the unusual thing about these web pages was that Symantec had not yet spotted any spam emails that contained links to the infected site.

"In the past, the Storm worm authors would directly link to malware on websites or within spam emails," Thakur said.

He speculated that the domains were still under development and would be used in the next big wave of Storm-related spam. In the past, events such as Christmas, New Year and Valentine's Day have seen hundreds of thousands of spam messages released, all linking to malicious web pages.

www.symantec.com

Back to index