We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
78,797 News Articles

Microsoft wins permanent settlement against Nitol botnet

Microsoft has won a battle to permanently disrupt a haven for the Nitol botnet that it discovered within an Internet domain controlled by a Chinese ISP.

The company has signed a private settlement that Peng Yong and Changzhou Bei Te Kang Mu Software Technology Co., Ltd., will block all connections to designated malicious subdomains of the 3322.org domain controlled by Peng and Bei Te Kang Mu Software.

BACKGROUND: Microsoft takes down another botnet, Nitol

DETAILS: Inside Microsoft botnet takedowns

Microsoft has identified those subdomains as hosting command and control servers for the Nitol botnet, which enlists infected machines into botnets that can execute distributed denial-of-service (DDoS) attacks and can also download malicious code for machines to perform whatever commands the bot commander directs.

Traffic to those 3322.org subdomains will be directed to sinkholes run in cooperation with either Microsoft or the China CERT (CN-CERT), according to the agreement, and log information about the computers trying to connect to the subdomains will be shared with CN-CERT. The designated subdomains will be de-registered as well, the agreement states.

Peng and Changzhou Bei Te Kang Mu Software agree to try to help find owners of the machines trying to make connections and to help the owners remove malware from the computers, the agreement says. In addition, Peng and his business will post a public policy asserting zero tolerance for illegal activity in the 3322.org domain.

Microsoft had won a temporary restraining order giving it control of 3322.org, and the agreement says it will return that control to Peng.

Microsoft came across the Nitol refuge when it was following up on a case of new computers being sold in China with pirated Microsoft software and Nitol malware preinstalled. It won a U.S. court order to gain control of 3322.org until Peng could respond to a lawsuit filed by Microsoft against him. Part of the agreement is that Microsoft will drop the suit.

Tim Greene covers Microsoft for Network World and writes the Mostly Microsoft blog. Reach him at tgreene@nww.com and follow him on Twitter @Tim_Greene.

Read more about wide area network in Network World's Wide Area Network section.


IDG UK Sites

Android One vs Android Silver vs Google Nexus: What is the difference?

IDG UK Sites

iOS 8 review: Hands on with the iOS 8 beta

IDG UK Sites

Long live the internet fridge: the Internet of Things is coming

IDG UK Sites

How Prometheus' colourist Juan Ignacio Cabrera gave a tense, edgy feel to Chosen