Hot on the heels of this story about one million Chinese PCs succumbing to viruses last week comes a fascinating analysis of a viral nightmare called Storm that's thought to infect between one and 50 million computers worldwide. Although it's been around for a year, no one really knows the extent of its spread, and because of the way it's been designed, anti-virus companies "are pretty much powerless to do anything about it."

It seems the bad guys have learnt a lot of lessons from earlier worms. Storm is quiet. You're not likely to notice it because it doesn't cause any damage or a noticeable performance hit. "Like a parasite, it needs its host to be intact and healthy for its own survival." It also has a decidely 'biological' design; "Only a small fraction of infected hosts spread the worm. A much smaller fraction are... command-and-control servers. The rest stand by to receive orders. By only allowing a small number of hosts to propagate the virus and act as command-and-control servers, Storm is resilient against attack. Even if those hosts shut down, the network remains largely intact, and other hosts can take over those duties."

By using peer-to-peer networking instead of direct communication with a central server, and a payload that morphs every 30 minutes, it's very difficult to detect -- or track down who's behind it. Not that it seems to be doing much at the moment, other than delivering spam and attacking anti-spam sites. But once the infrastructure's there, what are we in for?

What's really creepy is that there doesn't seem to be a solution. "Redesigning the Microsoft Windows operating system would work, but that's ridiculous to even suggest."

Read more here.