[26763] in resnet
Re: Zeus botnet anyone?
daemon@ATHENA.MIT.EDU (THETFORD, CHARLES)
Fri Sep 16 13:34:14 2011
Content-Language: en-US
Content-Type: text/plain; charset="Windows-1252"
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Message-ID: <C544434DCCD7F640986F094E22E55B3B01742F16A7BE@AGCMS.fs.dew.twu>
Date: Fri, 16 Sep 2011 12:29:18 -0500
Reply-To: Resnet Forum <RESNET-L@listserv.nd.edu>
From: "THETFORD, CHARLES" <CThetford@mail.twu.edu>
To: RESNET-L@listserv.nd.edu
In-Reply-To: <4E7382BC.1040704@bristol.ac.uk>
Does it act as a rogue dhcp server?
Chuck Thetford
TWU
________________________________________
From: Resnet Forum [RESNET-L@LISTSERV.ND.EDU] On Behalf Of James J J Hooper [jjj.hooper@bristol.ac.uk]
Sent: Friday, September 16, 2011 12:09 PM
To: RESNET-L@LISTSERV.ND.EDU
Subject: Re: Zeus botnet anyone?
On 16/09/2011 17:56, Crowe, Sheila wrote:
> Hey Everyone,
>
> Does anyone have any experience with ridding your network of this scourge?
> We believe that one of our VLANs may include a “bot master” and he’s
> killing us over there. It has taken us this long to just find out what the
> problem is. Any tips, hints, references for Voodoo docs, questions…all are
> welcome.
>
> TIA,
>
> Sheila Crowe
>
> Montana State University ResNet
We have DNS blocks on malware via various DNSRBLs. Any web traffic is
redirected to a box that via the resources at:
https://zeustracker.abuse.ch/
determines if the particular 'hit' is zeus.
Clients with more than 5 HTTP GETs, or any HTTP POSTs, that match Zeus are
contacted (wired) or contacted+access revoked (wireless or VPN).
-James
___________________________________________________
You are subscribed to the ResNet-L mailing list.
To subscribe, unsubscribe or search the archives,
go to http://LISTSERV.ND.EDU/archives/resnet-l.html
___________________________________________________
___________________________________________________
You are subscribed to the ResNet-L mailing list.
To subscribe, unsubscribe or search the archives,
go to http://LISTSERV.ND.EDU/archives/resnet-l.html
___________________________________________________
