But these sites already exist. There are many security sites. The defacto standard unbiased site is:
http://www.cert.org/The problem is, the ISPs and primarily businesses just plain don't give a fuck. You can even go so far as to offer to go in and fix their routers for them and they will probably ignore you or think you are a hacker.
One other minor correction. I have cleaned up machines that have been exploited and I don't believe "virus" is the correct term to use in how they are exploited and set up to participate in a DDoS. It could have been an automated process to install the root kit and start the scanning process but on the machines I have cleaned up they were not set up to exploit other machines so I would certainly not consider it a virus.
Usually a scan is done for a specific vulnerability on a block of IP addresses. If the exploit is detected a root kit is installed via the exploited security hole. Usually these root kits contain a password sniffer that monitors the local network the machine is on for clear text passwords (grabbed from telnet or ftp sessions since they are not encrypted). At regular intervals the passwords that have been collected are emailed to a collection email address. They also have a DDoS process running that is waiting on commands from headquarters to attack.
They install these programs in a directory that they create in some obsure location like "/dev/.hardrive". Then as part of the root kit are modified copies of "ps", "top", "ls", "netstat", etc. When these replacement commands are run they will hide the bad processes, directories, and network ports so it would appear that everything that should be running is running and nothing more. At least to someone who doesn't run tripwire and other intrusion detection utilities.
I once had someone call me because they said they noticed a minor difference in their "top" command. They said a few days previous when they ran it, it showed both processors in the CPU stats (was a dual processor box) and now it only showed one processor. I logged in and looked at it and initially said they were crazy. The assured me that this was so. So I did a "rpm -V procps" and sure enough it was not the original top and I knew immediately this machine had been rooted.
The first thing I did was to copy some known good copies of "ls", "ps", "find", etc to a separate directory and adjusted my PATH to look in that directory first. After figuring out some dates and running the "find" command based on those dates I found most of the root kit and I could see what sniffer and DDoS processes were running etc. Once you find part of it, finding the rest isn't very hard by analyzing what you have found. And of course "rpm -V" every package on the system to check for any other things that have changed. You also want to check over your /etc/passwd file for any users they may have added and changing all passwords is a must for any users that have login capability. It's almost easier to restore the entire system from a backup. Or copy all configuration files and data and reinstall from scratch.
And lastly of course, update the system and close the holes. And tripwire is a good tool but it's sad how few people use it. It's good to have as many security utilities running as you can so if they check for and defeat one you may get them with the others. Of course if you are that security concious from the start you likely never would have been rooted because you would have been keeping up with the CERT advisories and fixed any known exploits.
