427 Botnet fm qxd

www.syngress.com/solutions
and click on the 
“Ask the Author”
form. 
427_Bot_ch04.qxt 1/9/07 3:03 PM Page 131

---

Q: 
What sets Mytob apart among the bot families discussed in this chapter?
A: 
Mytob is not a bot in and of itself. It is a mass-mailing worm that includes
SDBot as part of its payload, providing a hybrid attack that can compro-
mise more systems with the bot software faster.
Q: 
What is a common method bot families use to avoid detection or
removal?
A: 
Many bots, and even viruses, worms, and other malware, search for and
terminate processes associated with common antivirus or security applica-
tions to shut them down.
Q: 
How do some bots ensure that infected systems are not able to research
information or obtain updates from antivirus vendors?
A: 
Some bots modify the Hosts file on the compromised system to redirect
requests for antivirus and other security-related Web sites to the loopback
address of 127.0.0.1, blocking attempts to reach those sites.
Q: 
Which bot family creates entries in the Windows registry to prevent users
from installing Windows XP Service Pack 2?
A: 
The Spybot family adds registry entries to block the installation of
Windows XP SP2, as well as registry entries to disable the Windows
Firewall and the Windows Security Center.
www.syngress.com
132
Chapter 4 • Common Botnets
427_Bot_ch04.qxt 1/9/07 3:03 PM Page 132

---

Botnet 
Detection: Tools 
and Techniques
Solutions in this chapter:
■
Abuse
■
Network Infrastructure: Tools and