The Storm Worm, which originally debuted in January, is making the rounds again, using multiple routes designed to trick users into activating the worm. Most recently, Storm Worm, which is also known as CME-711, Trojan-Downloader.Win32.Agent.bet, Trojan.Peacomm, Email-Worm.Win32.Zhelatin.a, Email-Worm.Win32.Zhelatin.d, Email-Worm.Win32.Zhelatin.b, and Email-Worm.Win32.Zhelatin.c, among others, has been enticing users with phony e-card emails. It has also crossed over into Google's Blogger, leaving phony comments with clickable links that infect the unsuspecting visitor. The route of infection into Blogger isn't clear, but Blogger does allow known email addresses to post comments. It's possible that compromised, Blogger-authorized email addresses account for the worm's appearance on that site.

The Storm Worm, which is a variant of the Small.DAM worm, has a threat level of "2" as rated by F-Secure. Sunbelt software rates the worm's threat level as "Severe." One reason this worm has generated so much interest is the persistence with which the authors are attempting to infect unsuspecting clients. Storm's infection rate is approaching nearly 2 million computers worldwide.

Removal of the worm is not particularly difficult, but the spread of the infection points out the number of systems that remain vulnerable, even though Storm Worm uses known, patched exploits to propagate. CERT issued an advisory on Storm Worm regarding the fake e-cards. The best protections against infection continue to be the regular updating of virus signature files, the blocking of executable and unknown file types at email gateways, and the reminder to users that opening e-cards from unverified sources is a bad idea.