Why do researcher need to control all C&C servers of a botnet?
Wouldn't it be easier to spread a deinstall command to all reachable PCs to cripple the botnet? This could be done over and over again until most PCs are clean.
Apparently I don't know enough about botnets, so please help me out. Do clients check commands from multiple sources? I.e. in a P2P botnet, do they accept multiple commands from various other bots and then compare them to check which one is valid? Same for C&C servers. Will they connect to the first active C&C and execute whatever command is placed for there? If so, the only two things hindering researchers from using the botnet infrastructure is access to C&C servers and possibly encryption keys to send valid commands.
The point is that simply removing the C&C servers leaves the affected PC wide open an possibly even in a state where it constantly tries to communicate with other bots / download commands? So if ever another C&C server gets reachable, the bots will be active again.
A possible reason that sprung to my mind was that deinstalling anything from a target PC could possibly be seen as an unlawful interaction with one's PC.