quote:
Originally posted by saralk
Is this a virus that connects to a botnet?
If it is, then can't someone find out what channel all these viruses are connecting to, find out the password of the virus, and then tell all the bots to download a tool that will uninstall the virus.
No, and no.
Botnets have far better protection from outsiders than that.
First the channel is set +u (if the IRCd is UnrealIRCd) so that anyone who isn't an op (all the bots, and you if you joined the channel) can only see ops in the channel. If you joined the botnet channel you'd only see people who were op, and that'd be only a couple of people.
Then there's a password to login to the bots, that is easily found if you have the trojan's exe, but it is almost useless in a case like this because the bots will only allow people with a certain hostmask to login.
A hostmask is something like this:
myles@dsl181-113-076.dfw1.dsl.speakeasy.net
That's ident@hostname and hostname is something your ISP will give you. The problem is, since the bot owners own the server and are administrators of the IRC server, they can set their hostname to be anything they want. Usually it's something stupid like fbi.gov, something no one could get.
So no, it's not that easy...
ShawnZ: Windows' task manager won't give you any clue which csrss.exe is the trojan one.
