Microsoft has won a battle to permanently disrupt a haven for the Nitol botnet that it discovered within an Internet domain controlled by a Chinese ISP.

The company has signed a private settlement that Peng Yong and Changzhou Bei Te Kang Mu Software Technology Co., Ltd., will block all connections to designated malicious subdomains of the domain controlled by Peng and Bei Te Kang Mu Software.

BACKGROUND: Microsoft takes down another botnet, Nitol

DETAILS: Inside Microsoft botnet takedowns

Microsoft has identified those subdomains as hosting command and control servers for the Nitol botnet, which enlists infected machines into botnets that can execute distributed denial-of-service (DDoS) attacks and can also download malicious code for machines to perform whatever commands the bot commander directs.

Traffic to those subdomains will be directed to sinkholes run in cooperation with either Microsoft or the China CERT (CN-CERT), according to the agreement, and log information about the computers trying to connect to the subdomains will be shared with CN-CERT. The designated subdomains will be de-registered as well, the agreement states.

Peng and Changzhou Bei Te Kang Mu Software agree to try to help find owners of the machines trying to make connections and to help the owners remove malware from the computers, the agreement says. In addition, Peng and his business will post a public policy asserting zero tolerance for illegal activity in the domain.

Microsoft had won a temporary restraining order giving it control of, and the agreement says it will return that control to Peng.

Microsoft came across the Nitol refuge when it was following up on a case of new computers being sold in China with pirated Microsoft software and Nitol malware preinstalled. It won a U.S. court order to gain control of until Peng could respond to a lawsuit filed by Microsoft against him. Part of the agreement is that Microsoft will drop the suit.

Tim Greene covers Microsoft for Network World and writes the Mostly Microsoft blog. Reach him at [email protected] and follow him on Twitter @Tim_Greene.

Read more about wide area network in Network World's Wide Area Network section.