We have become aware of a second variant of the Small Trojan that is known as Storm Worm. Similar to the first variant, this one is also a mass-mailer that uses social engineering and network shares to propagate. The Storm Worm variant creates a peer-to-peer network that operates on port 7871/UDP, while the previously reported variant, known as Small.DAM or Trojan.Peacomm, operates on port 4000/UDP.

The Small Trojan variants arrive as an email attachment and also propagate through network file shares. These Trojan variants drop two files upon execution, one of which may contain rootkit functionality. These Trojan variants also create a back door that may be used to harvest sensitive data or launch a spam attack.

Subject lines can change at any time, but the following are currently being used by these Trojans:

• 230 dead as storm batters Europe
• A killer at 11, he's free at 21 and...
• British Muslims Genocide
• Naked teens attack home director
• U.S. Secretary of State Condoleezza...
• Russian missile shot down Chinese aircraft
• Russian missle shot down Chinese satellite
• Russian missle shot down USA aircraft
• Russian missle shot down USA satellite
• Chinese missile shot down USA aircraft
• Chinese missile shot down USA satellite
• Chinese missile shot down Russian satellite
• Chinese missile shot down Russian aircraft
• Sadam Hussein alive!
• Sadam Hussein safe and sound!
• Radical Muslim drinking enemies' blood
• 230 dead as storm batters Europe.
• Re: Your text
• Venezuelan leader: "Let's the War beginning".
• Fidel Castro dead.

File names can also change at any time, but the following are currently being used:

• Full Clip.exe
• Full Story.exe
• Full Video.exe
• Full Text.exe
• Full Story.exe
• Full News.exe
• Read More.exe
• Video.exe
• GreetingPostcard.exe
• MoreHere.exe
• FlashPostcard.exe
• GreetingCard.exe
• ClickHere.exe
• FlashPostcard.exe

However, these subjects and filenames can change at any time, so do not open any attachments unless you are sure they are not executable programs, even if they are from people you know. Email worms such as Storm Worm travel by emailing themselves to people in computer address book without the infected person's knowledge, and thus it's almost certain that you know whoever emailed you the worm.

If you run a firewall and are comfortable with doing so, you can block UDP ports 7871 and 4000. Most personal firewall will automatically block all unused ports such as these, only opening ports when they are needed.

Internet Security (see right sidebar) is your best bet for protection, although SystemWorks and SystemWorks Premier will protect you also, and even Antivirus will help if you have some other software firewall.