Microsoft, FBI and Interpol team up to eliminate the Dorkbot botnet
Microsoft helped FBI and other agencies in virus repair of massive botnets, which were in a number of millions
News from our Virus Repair Team: Before we start, some of you may want to ask “What is a botnet?”. Well, whenever a malicious code is installed on a remote victim by the ways of phishing or exploiting software vulnerabilities, the victim’s machine becomes a “zombie”. A collection of such zombies in a network is called a botnet.
Discovered in 2011, the Win32/Dorkbot malware has spread to over a million Windows PCs worldwide. During the last six months alone it had been infecting over 100,000 machines a month. Microsoft announced on Wednesday they had teamed up to enact a coordinated virus repair campaign to disrupt the botnet.
The malware has been spread via a number of routes including USB drives, IM clients, Social Networks, Email and Drive-by downloads. Its primary aim was to steal online user credentials and any information that can personally identify you. It is also able to install yet more malware to your PC from command and control servers.
In order to take down Win32/Dorkbot, Microsoft worked with a number of organizations including ESET, Department of Homeland Security, Europol, FBI and Interpol. The take-down joins a long list of ongoing successful efforts to disrupt malware networks.
While not much was given away on actual specifics of the dismantling technique used, we do know it’s based on their established Coordinated Malware Eradication initiative. The CME program aims to co-ordinate information exchange and response from six key sectors. The goal being: Prosecute, Starve, Identify & Block, shun and set policies. Microsoft is strategically cooperating with a diverse set of businesses and institutions, with each having their own role to prosecute in the operation.
- Security vendors: By sharing detection methods, malware behavior, and unpacking techniques, vendors can more quickly identity and block the malware families as they appear on network-connected endpoints and servers.
- Financial institutions, online search, and advertising businesses: With better fraudulent behaviour identification, these organizations can starve malware authors of their ill-gotten gains.
- CERTs and ISPs: Armed with vetted lists, CERTS and ISPs can block and take down deploy sites, and command and control servers.
- Law enforcement: Using correlated evidence, law enforcement can prosecute the people and organizations behind the malware.
- Be cautious when opening emails or social media messages from unknown users.
- Be wary about downloading software from websites other than the program developers.
- Run antimalware services from A Geek To Go! regularly.
Microsoft also provides some additional tools which can scan and remove this family of malware.
Keep on checking out us for updates and practical tips to stay safe online.