Symantec: Storm worm changes tack

Symantec: Storm worm changes tack

Summary: The worm's authors have streamlined the code to make it more stable, researchers have claimed

TOPICS: Security

The Storm worm has evolved again, researchers from Symantec claim.

To streamline the worm and make it more stable, the malware authors have shed key functionalities in the malicious code, said the researchers.

The worm no longer infects other legitimate drivers on the system, instead relying on its own proprietary components to "do its dirty work". It also no longer injects itself into processes such as Explorer.exe, according to a blog post by Symantec security researcher Thomas Parsons.

"The sustained development of the Storm worm (incorporating review cycles) indicates that we will continue to see solid infection rates going forward," wrote Parsons. "So, unlike the natural phenomenon, this storm continues to huff and puff and it doesn't look like it is petering out anytime soon."

The Storm botnet was initially created at the beginning of 2007, when the Storm worm was sent out via spam, hiding in email attachments with a subject line of "230 dead as storm batters Europe".

Topic: Security

Tom Espiner

About Tom Espiner

Tom is a technology reporter for He covers the security beat, writing about everything from hacking and cybercrime to threats and mitigation. He also focuses on open source and emerging technologies, all the while trying to cut through greenwash.

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.


Log in or register to start the discussion