Kneber bot

Zlog,

Personally, I do not believe I am the best to respond, but here is what I have determined so far.  Kneber is using an older version (1.2) of Zbot (aka ZeuS) to infect.  I have found a great, quick read at :

http://www.computerworld.com/s/article/9159138/Kneber_just_another_botnet_

A quick discussion by Sophos re: Zbot is at:

http://www.sophos.com/blogs/sophoslabs/v/post/2090

But if you want to get a little scared, read this:

http://www.darkreading.com/security/antivirus/showArticle.jhtml?articleID=220000718

The next action item on my list is to map the Sophos names of the Zbot variants (A through ... I don't know) to the version number referenced in the first article.  But, those links should mostly answer your question, even though I think some announcement from Sophos would provide a nice "warm fuzzy".

Enjoy!!

Check out:

http://www.sophos.com/blogs/gc/g/2010/02/19/zeus-kneber-botnet-unmasked/

Regards,

John

Thanks for your response.

Thanks John.