We reported in October last year that the Storm botnet was pretty much gone, but German researchers at Bonn University and RWTH Aachen University believe around 100,000 machines remain infected. That’s despite the efforts of Microsoft to diffuse it with their Malicious Software Removal Tool.
Those same researchers believe they have a solution that should eradicate the worm completely, however. Rather than try and block it or delete it, they decided to find out how the worm functions. Once they had figured that out it was possible to write software that could communicate with Storm.
The worm requires servers to act as controllers so when a new machine is infected it starts looking for a controller. The researchers are able to mimic the control server and catch any infected machines looking for a server. Once a machine has been identified in this way it can be neutralized remotely by cleaning up the infected computer with downloaded security software.
By using this method it is possible to create servers that intercept Storm and kill it without a user having to do anything. The one problem with this technique being it is a bit controversial as it involves accessing a machine without permission. Ultimately, even though they are doing this for a positive outcome it could still be deemed illegal in many areas of the world.
Read more at PC Pro
They haven’t setup a server yet that can carry out this eradication because of the potential law issues, but it does sound like a very simple and effective solution.
There are other problems to using it though. A user may be infected and have security software running. So if this system attempted to fix the problem it may either get blocked, or cause even more problems on the machine due to it attempting to circumvent the security the machine does have.
You can argue that the only machines that would be accessed are those infected and therefore would cause a bigger problem if not addressed making this practice acceptable. Do you think remotely accessing a machine to fix it is the right thing to do?