Yep, but it's a lot of work. There at least a few researchers that keep track of bot activity, reverse samples, monitor via wire-compatible clients, etc. From w

Yep, but it's a lot of work. There at least a few researchers that keep track of bot activity, reverse samples, monitor via wire-compatible clients, etc. From what I gather it's getting harder, some newer worms use decentralized control channels, signed updates, etc. One way to observe worm behavior: http://www.honeynet.org/ http://www.honeynet.org/ SRI writeup on their dissection of Storm: http://www.cyber-ta.org/pubs/StormWorm/report/ http://www.cyber-ta.org/pubs/StormWorm/report/