Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 3 replies
  • Subscribers 6 subscribers
  • Views 3130 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

BOTNET DETECTION

POLTROON

Does SOPHOS detect if a computer is part of a BOTNET ?:smileysurprised:

If not does someone know a product that does ?

:1002133


This thread was automatically locked due to age.
Parents
  • 0

    Those are all Java-based infections, and so *could* apply to OS X, but these don't.

    Mal/JavaHeL0H detects a crimepack for Windows XP/IE

    Mal/JavaKP-G detects a java-based downloader (downloads Windows malware)

    Mal/JavaKP-H works with the other two to make all the magic happen.

    So what you've got is likely a Windows-targeted drive-by download in your JavaWebCache.

    If I understand correctly, it is "clean up manually" because it's attempting to clean up cache files that you don't have direct access to as a regular user -- so you need to custom scan and clean up instead.

    In SAV, "Clean up manually" doesn't mean you have to go and remove the files yourself; it just means the software won't do everything for you without some user interaction.  "Clean up manually" is language from the Enterprise version where a system admin does most of the work automatically from a management console and doesn't touch the endpoints himself.

    :1002149
Reply
  • 0

    Those are all Java-based infections, and so *could* apply to OS X, but these don't.

    Mal/JavaHeL0H detects a crimepack for Windows XP/IE

    Mal/JavaKP-G detects a java-based downloader (downloads Windows malware)

    Mal/JavaKP-H works with the other two to make all the magic happen.

    So what you've got is likely a Windows-targeted drive-by download in your JavaWebCache.

    If I understand correctly, it is "clean up manually" because it's attempting to clean up cache files that you don't have direct access to as a regular user -- so you need to custom scan and clean up instead.

    In SAV, "Clean up manually" doesn't mean you have to go and remove the files yourself; it just means the software won't do everything for you without some user interaction.  "Clean up manually" is language from the Enterprise version where a system admin does most of the work automatically from a management console and doesn't touch the endpoints himself.

    :1002149
Children
No Data