Real.
Overview -
This is a trojan detection. Unlike viruses, trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted. The most common installation methods involve system or security exploitation, and unsuspecting users manually executing unknown programs. Distribution channels include email, malicious or hacked web pages, Internet Relay Chat (IRC), peer-to-peer networks, etc.
Characteristics
Characteristics -
As many other DDoS trojan Storm has two main parts. A server that runs on compromized systems and a client, from which the hacker controls the DDoS attack. Different variants exists of this threat which may show sligtly different behaviours.
The server part, when executed, goes resident and opens a listening port (TCP 41337). When the it receive a command from the client part it initiate a dos attack targeting a specific host. It sends loads of invalid IP fragments with the intent of eating up the victim server resources.
Some variants let the victim know they are running, some don't.
Symptoms
Symptoms -
Presence of the following files:
* [various] 298496 server variant
* c:\windows\wkernel.exe 174080 server variant
* [various] 177152 server variant
* [various] 22528 client variant
* [various] 49664 client variant
Some variants let the victim know they are running, some don't and hooks themself into the registry.
Method of Infection