Bot
This afternoon I spent a couple hours dissecting a war bot. I would say it was not very polished, but it was interesting nevertheless. It disguised itself as a standard service using the name svchost.exe. In reality it was a custom version of mirc running as a bot, with tons of scripts and the ability to update itself. All it wanted to do is download music from the IRC rooms.
It started itself by placing a basic entry in the registry:
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
"run"="c:\\windows\\system32\\include\\svchost.exe"
Then it would run a series of .reg files placing various other entries into the registry that hijacked the web browser and popped tons of windows. That was only a distraction so you would not notice it had launched mirc with a transparent icon.
Anyway, it was OK. You could do so much more harm by beeing more stealthy.
09/04/02006 10:38 PM
