427 Botnet fm qxd

www.syngress.com
398
Chapter 11 • Intelligence Resources
427_Botnet_11.qxd 1/9/07 9:56 AM Page 398

---

years, those that have been previously discovered on systems have already been
submitted to antivirus, antispyware, and antimalware software vendors. As
such, their software can remove numerous botnets residing on a computer,
and their sites provide whitepapers, articles, forums, and information on indi-
vidual Trojans (inclusive to botnets). Some of the major sites providing these
services include:
■
Grisoft
(www.grisoft.com) AVG antivirus, antimalware, antispyware,
personal firewall software, and other tools to safeguard systems.
■
Lavasoft
(www.lavasoft.de) Ad-aware spyware removal tool and a
personal firewall.
■
McAfee
(www.mcafee.com) McAfee Antivirus.
■
Microsoft Security
(www.microsoft.com/security/) The Microsoft
Malicious Software Removal Tool, created by Microsoft to remove
malware from systems. Because most botnets are designed to attack
Microsoft systems, their security section shouldn’t be overlooked as a
resource, nor should the updates and patches provided on the
Windows Update site (http://windowsupdate.microsoft.com).
■
Symantec
(www.symantec.com) Norton Antivirus and other tools
for safeguarding systems and removing malicious software and viruses.
■
Spybot Search & Destroy
(www.safer-networking.org) Spybot
Search & Destroy, RunAlyzer, FileAlyzer, and RegAlyzer for
removing and analyzing spyware and malicious software.
Viewing Information on Known Bots and Trojans
Sites like Symantec provide information on known viruses and Trojans that its
software protects against. As seen in Figure 11.3, by looking through their
online database for information on a particular botnet that’s found on your
system, you can obtain significant information on its origin, what it does,
removal procedures, and other information. Because botnets can modify the
Windows registry, download and use multiple files, and make other modifica-
tions to a computer, it is important to follow proper removal procedures to
fully eliminate the botnet’s presence from a system.