How do you detect a botnet? Impossible, right?
in [Anti-Virus]
|
From: FromTheRafters on 22 Feb 2010 07:25 "David Kaye" <sfdavidkaye2(a)yahoo.com> wrote in message news:hlt6og$3us$2(a)news.eternal-september.org... > "FromTheRafters" <erratic(a)nomail.afraid.org> wrote: > >>Think of a bot as an application running in the background mostly >>waiting for instructions, not like a worm gobbling up your resources >>to >>spread itself or adware getting 'in your face'. > > I know what a bot is, thank you very much. Then what makes you think they would manifest themselves as "slowdowns, suspicious disk activity, freaky behavior."? You could be hosting a bot without *any* user noticeable symptoms.
From: David H. Lipman on 22 Feb 2010 16:16 From: "FromTheRafters" <erratic(a)nomail.afraid.org> | "David Kaye" <sfdavidkaye2(a)yahoo.com> wrote in message | news:hlt6og$3us$2(a)news.eternal-september.org... >> "FromTheRafters" <erratic(a)nomail.afraid.org> wrote: >>>Think of a bot as an application running in the background mostly >>>waiting for instructions, not like a worm gobbling up your resources >>>to >>>spread itself or adware getting 'in your face'. >> I know what a bot is, thank you very much. | Then what makes you think they would manifest themselves as "slowdowns, | suspicious disk activity, | freaky behavior."? You could be hosting a bot without *any* user | noticeable symptoms. Often the ONLY indication is "beaconing" to a foreighn host. -- Dave http://www.claymania.com/removal-trojan-adware.html Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp
From: FromTheRafters on 22 Feb 2010 21:33 "David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in message news:hlus7002i78(a)news3.newsguy.com... > From: "FromTheRafters" <erratic(a)nomail.afraid.org> > > | "David Kaye" <sfdavidkaye2(a)yahoo.com> wrote in message > | news:hlt6og$3us$2(a)news.eternal-september.org... >>> "FromTheRafters" <erratic(a)nomail.afraid.org> wrote: > >>>>Think of a bot as an application running in the background mostly >>>>waiting for instructions, not like a worm gobbling up your resources >>>>to >>>>spread itself or adware getting 'in your face'. > >>> I know what a bot is, thank you very much. > > | Then what makes you think they would manifest themselves as > "slowdowns, > | suspicious disk activity, > | freaky behavior."? You could be hosting a bot without *any* user > | noticeable symptoms. > > > > Often the ONLY indication is "beaconing" to a foreighn host. Something not at all obvious to the casual observer. Bots share that trait with the slow polymorphic virus - if you don't draw attention to yourself, it is a clear advantage in stickiness - hiding yourself (and your activities), even more so.
From: David H. Lipman on 22 Feb 2010 21:46 From: "FromTheRafters" <erratic(a)nomail.afraid.org> | "David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in message | news:hlus7002i78(a)news3.newsguy.com... >> From: "FromTheRafters" <erratic(a)nomail.afraid.org> >> | "David Kaye" <sfdavidkaye2(a)yahoo.com> wrote in message >> | news:hlt6og$3us$2(a)news.eternal-september.org... >>>> "FromTheRafters" <erratic(a)nomail.afraid.org> wrote: >>>>>Think of a bot as an application running in the background mostly >>>>>waiting for instructions, not like a worm gobbling up your resources >>>>>to >>>>>spread itself or adware getting 'in your face'. >>>> I know what a bot is, thank you very much. >> | Then what makes you think they would manifest themselves as >> "slowdowns, >> | suspicious disk activity, >> | freaky behavior."? You could be hosting a bot without *any* user >> | noticeable symptoms. >> Often the ONLY indication is "beaconing" to a foreighn host. | Something not at all obvious to the casual observer. Bots share that | trait with the slow polymorphic virus - if you don't draw attention to | yourself, it is a clear advantage in stickiness - hiding yourself (and | your activities), even more so. Yes and in this case the rate of beaconing can further limit detection. -- Dave http://www.claymania.com/removal-trojan-adware.html Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp
From: David Kaye on 23 Feb 2010 05:27
"FromTheRafters" <erratic(a)nomail.afraid.org> wrote: >Then what makes you think they would manifest themselves as "slowdowns, >suspicious disk activity, > freaky behavior."? You could be hosting a bot without *any* user >noticeable symptoms. Could, but most of this malware is written so badly that it's usually evident. I used to write software for a living. 20% of the time was spent writing software and 80% was spent debugging. It's hard to write good code that will work well on all flavors of Windows with all kinds of hardware. Malware writers generally want to get it written and out the door; debugging is the least of their concerns. If it runs on 1% of the infected computers they're happy. |