asked on

What are best practice forensics after finding IRC bot

What are the best practices for followup to a bot removal? I was called on site to a clients small busines and found a very simple IRC bot installed that launched on startup and made no attempt to conceal itself. I was able to locate it without a great deal of time and effort, it was installed in a folder in System32\ but the ease with which I could find and remove it lead me to ask if there is false sense of security since the system scans show no virus and the system is working as expected. I cleaned a Storm Worm infected machine about two months ago and that was the most stubborn cleanup that I had seen in many years. With this one I deleted the folder and the registry entries and it was gone, just seemed too easy. The owner told me that he always ckill the applicaiton as soon as he booted up so I want to believe it never got past the immediate IRC logins.

In the properties of the executable the company name was 'GoHack, Inc.'

Bri

ASKER CERTIFIED SOLUTION

r-k

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

SOLUTION

msklizmantas

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

SOLUTION

Rich Rumble

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

BrianDSy

ASKER

It's hard to rate any of these as the ultimate solution, since I need to maintain a balance between the users freedom of choice in a small office and budget choices about offline storage. But after removing the registry keys that started the processes and restarting the machine I was able to remove the rest of the malware and run the System Restore function of windows using the boot CD. The first and last solutions are the best for the small business, the second one is an enterprise type solution. Resources in many of the small businesses I go to are stretched to the maximum.

Regards,
Brian

BrianDSy

ASKER

Thanks for the feedback. My clients happy. I feel like I got the job done. There have been no further issues.

Brian