Since Yesterday evening, the gang behind Nuwar (also called the Storm Worm), have registered a number of blogspot accounts to spread their malware. The malicious pages look like the following screen shot.
Clicking on the image will redirect the browser to an executable called love.exe while clicking on the link in the text below the image will download a file named withlove.exe. Both executables are variants of Nuwar. Our antivirus detects both files through our Web access protection module.
Pierre-Marc Bureau
Researcher
