The Bad Guys have devised a cunning new bit of social engineering to convince unsuspecting users to open their messages and let their malicious software install itself onto your computer. The tactic is to give the message a subject that looks like the message is about a breaking news story that the sender hopes you will want to read.

I first read about the "Storm worm" yesterday on eWeek, a well regarded electronic newspaper that caters to the IT industry.

Since reading the news article, I've seen two such suspicious messages in my own Inbox.

• Russian missle shot down Chinese aircraft
• Russian missle shot down Chinese satellite

Note that the word "missile" is misspelled.

One of the two contained an attachment, obviously a payload of some sort. Although the other showed no obvious signs of containing a payload, I took no chances and deleted it, too. Although I cannot confirm this, and have no intention of risking a test, I suspect that both of the above messages are variants of the message reported by F-Secure at http://www.f-secure.com/v-descs/small_dam.shtml.

Beware of messages from unknown senders that appear to be about breaking news stories. If you run with the preview pane disabled, as I do, you can safely delete the message.

As a rule of thumb, if anything about a message looks suspicious, don't open it. Instead, toss it into your Deleted Items folder and let the message archiving feature of your mail program dispose of it.

• At http://www.f-secure.com/v-descs/small_dam.shtml, Finnish security company, F-Secure, lists the headline "Storm worm uses European storm as a decoy," referring to F-Secure Trojan Information Pages: Small.DAM.
• At http://vil.nai.com/vil/content/v_99104.htm, McAfee identifies the same worm as W32/Storm.worm.
• http://www.eweek.com/article2/0,1895,2085606,00.asp?kc=EWEWEMNL011507EP28A is "Storm Worm Hits Computers Around the World," reported by the Reuters news service, and carried on the Web site of electronic newspaper eWeek.

David Gray, MBA, Chief Wizard WizardWrx, formerly P6 Consulting
	V: +1 (817) 812-3041 TZ: USA Central, GMT -6 E: dagray@wizardwrx.com W: www.wizardwrx.com	5006 Cloyce Court North Richland Hills, TX 76180-6944 USA
Tell me what you need, and I’ll conjure it.