Talk:Storm Worm

message: Whoever wrote "On April 1, 2008, a new storm worm was released onto the net, with April Fools-themed subject titles," where did you get your source? 168.28.180.30 (talk) 23:01, 2 April 2008 (UTC)
thread_title: Source needed

message: How is the botnet controlled by the "owner" if there is no central server? Cryptographically signed messages? --Apoc2400 18:12, 7 September 2007 (UTC)
replies: text: I'm guessing it's basically a tree. The central server sends a message to ~30 computers, these computers send messages to ~30 computers each, etc, until each computer receives a command. Now, I have no confirmation that this is how it works, I'm just guessing. ~ Oni Lukos ct 02:12, 8 September 2007 (UTC)

text: The way in which the individual infected computers get controlled might be related to the way other decentralized anonymous networks like Freenet work. 172.158.18.163 08:31, 8 September 2007 (UTC)
thread_title:  How is the botnet controlled? 

message: The classic definition of a 'Worm' is a self-propagating malware.  This malware is an email mass-mailing 'virus'.
66.129.224.36 18:04, 26 September 2007 (UTC)
replies: text: The technical definition of a virus is a parasitic, self-replicating program that requires a host file to exist. Storm isn't parasitic and doesn't self-replicate. It's a generally classified as a Trojan, bot or backdoor.  —Preceding unsigned comment added by Deaf-mute (talk • contribs) 15:56, 6 October 2007 (UTC)
replies: text: so how did it get to be called the Storm Worm? --71.116.133.208 15:50, 23 October 2007 (UTC)
replies: text: Often it's hard for AV analysts to fully understand how something works in the time they have available to write protection for it. Someone may have assumed that Storm was replicating automatically rather than acting as a backdoor and spam tool. Deaf-mute 20:46, 23 October 2007 (UTC)
replies: text: Since the Storm Worm isn't a worm, the article shouldn't refer to it as one. (ex: "The worm is also known as:")128.227.87.198 (talk) 14:08, 27 November 2007 (UTC)
thread_title:  "Worm" is a misnomer... 

message: Should this article be merged with Storm botnet, because that article is about the botnet that this worm creates? --ZeWrestler  Talk 15:12, 29 September 2007 (UTC)
replies: text: Yes. There isn't enough information in either article to separate them. 199.125.109.62 22:04, 10 October 2007 (UTC)
replies: text: Yes, arent't they too related to motivate separate articles? --Apoc2400 18:12, 24 October 2007 (UTC)
replies: text: I agree.128.227.87.198 (talk) 14:08, 27 November 2007 (UTC)
thread_title:  Merge? 

message: Perhaps this is a strange question to be left with, but the Storm Worm simply DOES an awful lot -- propagate by spam, network P2P-style, autonomously launch defensive DDoS attacks, detect virtual machines, etc.  How large is the executable file?  It can't be enormous to spread by email, but there's an awful lot of code at work.  Can anyone find a citation on this?
SpaceToast 21:14, 4 October 2007 (UTC)
replies: text: Storm hasn't spread as an email attachment since very early in 2007. Later variants all spread via HTTP with a link in the email. The distributed executable may just be a downloader for the full suite of malware.  —Preceding unsigned comment added by Deaf-mute (talk • contribs) 15:58, 6 October 2007 (UTC)
thread_title:  Size of Executable 

message: This website has a nice summary of the storm worm.
http://www.schneier.com/crypto-gram-0710.html#1  —Preceding unsigned comment added by 12.168.6.143 (talk) 18:14, 16 October 2007 (UTC)
thread_title:  Nice Reference 

message: Could we move this article to Waledac.
proof http://www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081231  —Preceding unsigned comment added by Rabbit67890 (talk • contribs) 03:10, 8 January 2009 (UTC)
thread_title:  Move 

message: Alright, I have a suggestion/request for a new section in the article on manually removing the virus. I think that it would be very helpful for the people who view the article. I know that I only came here to see if there might be any info on how to help my brother get rid of it, and I imagine that many other visitors come here for similar reasons. Now, I know that it could get a bit sticky, with the variants and what-not, however I assume that most of the variants operate in the same way, i.e.: Create directory 'x', place file 'y', start process 'z', etc. I understand that x, y and z would most likely have different names, in the different incarnations of the virus, however this would help identify patterns for people to look for, and then aid in removing it. Any thoughts?  Mr.Vanker (talk) 23:54, 11 November 2009 (UTC)
thread_title:  Manual Removal