[nsp-sec] ZeuS botnet (s288421667.onlinehome.us)

[Smith, Donald]

Dirk, your "unique bot ID" appears to be windows host names is that correct?

If so this is VERY helpful information.
One issue we often face is when notifying a customer they don't know WHICH computer is infected. We can only track it to the account/ip not to a specific computer in their network.



(coffee != sleep) & (!coffee == sleep)
Donald.Smith at qwest.com gcia   

> -----Original Message-----
> From: nsp-security-bounces at puck.nether.net 
> [mailto:nsp-security-bounces at puck.nether.net] On Behalf Of 
> Dirk Stander
> Sent: Tuesday, June 09, 2009 11:06 AM
> To: nsp-security at puck.nether.net
> Subject: [nsp-sec] ZeuS botnet (s288421667.onlinehome.us)
> 
> ----------- nsp-security Confidential --------
> 
>