New answers tagged botnet
When you attempt to take over control of a botnet, you are committing an act which is just as criminal as what the original owner of the botnet was doing. No matter how good your intentions are, you are taking control of other peoples IT systems, which is illegal in most parts of the world. Report the botnet to the authorities. When you don't believe that ...
If the httpd file was replaced, what ELSE was replaced? This looks like a 'nuke from orbit' scenario. As for taking over a botnet, that isn't a good idea. Whatever that botnet does can be attributed to you because you became one of the controllers in its network. Report to the authorities in your area.
Malware was detecting the presence of Rootkit Revealer, so they changed the way that program ran. It now is started by a windows service with a randomized executable name. Similarly, you could use a supervisor process to launch procmon and any other detected executables under "assumed" names.
Sorry to post a page of links, but you will find a ton of research at this link: http://www.cyberwarzone.com/understanding-and-mitigating-ddos-attacks-tools
You could read something like Infosec Institute's Botnets Unearthed – The ZEUS BOT, but it boils down to: It's not a peer to peer setup, it's a client/server setup. Malware clients try to contact command and control servers which are not behind firewalls that prevent access. You see a list of command and control nodes (or, better, make sure your own ...
There are a couple of ways. First, there are plenty of computers that are not behind NATing firewalls - the owners might be relying on Windows Firewall, or on nothing at all. Someone with a cable modem and PC with no router is wide open. Or a stateful firewall could be returning UDP packets to the originating machine.
Top 50 recent answers are included