Waledac Infection Check
Tuesday, March 2. 2010
Ben Stock has implemented a web service to check a given IP address for infection with Waledac, similar to the Conficker Eye Chart. The idea is that we are currently tracking Waledac as part of the take-down effort and thus we have a pretty good overview of the individual bots within the botnet. Therefore we are in a position to determine if we have seen a given IP address in the recent past as a bot, which indicates that this IP address might be related to a Waledac infection. Of course, effects like NAT or DHCP need to be taken into account: if an IP address is not listed, this does not necessarily mean that you are not infected.
The check is available at http://mwanalysis.org/waledac/, feedback is welcome!
The check is available at http://mwanalysis.org/waledac/, feedback is welcome!
