Suspicious Object / Zhelatin Worm

[M.J.Kim]

URL :

hxxp://uhavepostcard.com/happy-2008.exe

-> Backdoor.Win32.Agent.dln (KAV)

[JohnC]

Thank you, this will be added soon.

[Edgar Bangkok]

Now blogger is full of links at storm worm page     (newyeracards2008.com)
http://edetools.blogspot.com/2007/12/ora-storm-worm-attacca-blogger.html

Edgar from Bangkok

[sowhat-x]

b15.3222.org

Noticed this domain in a post in your blog,and recognized it immediately...
I've seen more 3222.org sites hosting crap,seems that they prefer it for some reason...
By the way,excellent work you keep doing...

[sowhat-x]

Regarding the happy-2008.exe crap,a short but nice analysis from Arbor Networks...
http://asert.arbornetworks.com/2007/12/storm-and-2008-new-campaign/

[brewt]

uhavepostcard.com
happycards2008.com
newyearcards2008.com
newyearwithlove.com
familypostcards2008.com

newest:

hxxp://freshcards2008.com/sony.exe
hxxp://freshcards2008.com/happynewyear2008.exe

http://www.siteadvisor.com/sites/freshcards2008.com

http://www.google.com/search?q=freshcards2008.com
how to report a spam blog

[brewt]

hxxp://happy2008toyou.com
hxxp://hellosanta2008.com
hxxp://happysantacards.com
hxxp://hohoho2008.com
hxxp://newscorpalerts.com
hxxp://parentscards.com
hxxp://postcards-2008.com
hxxp://santapcards.com
hxxp://santawishes2008.com

source: http://www.spamtrackers.eu/wiki/index.php?title=Storm#December_29

[sowhat-x]

Nice work 

hxxp://hohoho2008.com

-> He-he,yeah,ok...Santa Claus is coming to...your browser or so,twisted sense of humour...
my guess they were in a "mood" when registering this one...
He who laughs last,laughs best though...

[JohnC]

Thank you for the domains. You have to wonder how many people work on storm.