427 Botnet fm qxd

T
IP
Based on the raw XML analysis report you are able to create your own
customized HTML or plain-text transformation. For that you will have to
create an XSL template, which contains instructions on how to parse an
XML document. There exist several tools for performing the transforma-
tion. One easy way to do this is by including a line like this in the XML
file (you need to use the correct filename of your XSL with the 
href
parameter): 

Interpreting an Analysis Report
The results that can be obtained from the analysis of a malware application
can be used mainly for two purposes: protecting and disinfecting the bot
hosting client systems and destroying the functionality of the currently
existing botnet. Obviously, the botnet will be left ineffective if all bots have
been disabled, but because it is not possible to deactivate all bots at the same
time and because there always is the risk of new infections, it is also very
important to shut down the C&C server. Important analysis results that can
be used for the purposes of removing and avoiding the infection of a bot
application and of shutting down the botnet may be:
■
Where does the bot application store its files on the infected system?
■
What mechanisms are used to automatically start the bot application
at system startup?
■
How does the bot protect the infected host from infection by other
malware?
■
How does the bot protect itself from detection and removal?
■
How are new infectable hosts found? 
■
What exploits/mechanisms are used to infect new hosts?
■
How does the bot connect to the C&C server(s), and what servers
are used? 
■
Where does the bot application get updates from?
■
What malicious operations are performed locally and remotely?