Vulnerability Development: Re: Suspicious joe.exe

[Blake Frantz <blake () mc net>]

> Its an irc bot that is used to do distributed DoS attacks. The
> IRC channel acts command center for all the bots. You could sniff the
> traffic and figure out how to pretend to be irc bot to get into the
> channel. After that you can get IP/userinfo of person controlling
> all the bots. It probably came in email that you opened in outlook.
The majority of the boxes I find infected with such bots have vulnerable
IIS instances or world writable shares -- In addition to mail, might want
to check you patch levels and share permissions too.

-Blake