Storm Trojan floods e-mail boxes

Malicious Trojan horse software claiming to provide information on topics like the deadly storms that have battered Europe this week has infected thousands of computers over the past 24 hours, security vendor Sophos warned Friday.

The e-mail tries to entice victims into clicking on the malicious attachments by offering reports on topics like "230 Dead as storm batters Europe," or "U.S. Secretary of Sate Condoleeza Rice has kicked German Chancellor," said Graham Cluley, a senior technology consultant with Sophos.

The attachments have names such as "Full Story.exe" or "Full Video.exe." Once they are launched, these files install software that then waits to receive further instructions over the Internet, Cluley said. Unlike a worm, this Trojan software does not immediately seek out other targets to infect once it has been installed.

"You think you're reading a news report or you're watching a movie," he said. "It's the age old technique that we've seen since the mid 1990s: Here's something you want to look at. Look here!"

Cluley estimates that the Trojan accounted for about one of every 200 e-mails being sent on the Internet Friday.

These e-mails appear to have been particularly effective because they offer information on a topic that is of intense public interest in Europe right now. Over the past few days storms in northern Europe have caused widespread damage and killed close to 40 people.

Symantec has seen this particular Trojan variant in circulation since Wednesday, and has counted "thousands" of infections since then. "It's not a small threat, but it isn't an epidemic either," said Dave Cole, a director with Symantec Security Response.

This latest Trojan -- rated as a "medium" threat by Symantec -- is no more widespread than other similar outbreaks over the past year, but it has raised eyebrows by coming on so quickly, security expert said.

Some customers were finding that the Trojan was making up as much as 10% of all their incoming e-mail on Thursday, said Adam O'Donnell, a senior research scientist at Cloudmark. "It's not as bad as some other ones," he said. "It just sped up so quickly, it caught some people by surprise."

The IDG News Service is a Network World affiliate.