Anti-Virus' Trouble with Botnets
Keeping up with botnet tactics can look like a futile effort sometimes. Businesses need to understand that anti-virus software isn't always a match for today's botnets.
Dark Reading reports that business need to do more to clean up their own house to get a handle on bots on their networks:
Botnets also tend to operate in multiple stages: A user may first get infected by a piece of malware, but by the time AV detects it, the malware will have downloaded a second stage of malware, deleting the original infected file, for instance, he says. Many botnets also disable AV so they can remain undetected, Sergeant [senior anti-spam technologist for MessageLabs] says.
FYI, its no trivial task. As a start, block port 25 for traffic not to email servers and watch for some distinctive traffic patterns indicative of botnets. (See the article for details).
Email This!
Digg it!
Sphere it!
Del.icio.us
Reddit!
Newsvine
