Anti-Rootkit Blogger steo writes:

It has been reported that the authors of the Storm Worm which uses a rootkit called wincom32 have changed their code and tactics to try and avoid detection but in doing so have left bugs in the code.


The list of?email subjects?also?has?grown.

Chinese missile shot down USA aircraft
Chinese missile shot down USA satellite
Fidel Castro dead.
First Nuclear Act of Terrorism!
Happy World Religion Day!
Hugo Chavez dead.
President of Russia Putin dead
Radical Muslim drinking enemies? blood.
Russian missle shot down Chinese satellite
Russian missle shot down USA aircraft
Russian missle shot down USA satellite
Sadam Hussein alive!
Sadam Hussein safe and sound!
Safe and Sound
The commander of a U.S. nuclear submarine lunch the rocket by mistake.
The Supreme Court has been attacked by terrorists. Sen. Mark Dayton dead!
Third World War just have started!
U.S. Secretary of State Condoleezza Rice has kicked German Chancellor Angela Merkel
U.S. Southwest braces for another winter blast. More then 1000 people are dead.
Venezuelan leader: ?Let?s the War beginning?.
A full list of the new subjects is at the link above.

Another thing of note is that the new version of this spambot uses a different port to connect to the other bots.
“The latest version of the bot now tries to communicate with other bots on port 7871 instead of 4000 as in the previous version.”

Related articles:

Storm Battered Europe – Worm Batters Computers by Corrine
The Storm Continues by Corrine