HI victor,

Though ,Zeus botnet crime ware kit, act as anti forensic methods, it has many vulnerabilities, which can be traced with a forensic tool. that is quite interesting.

Zeus has stolen many data as u said.

if we can extract the encryption key from the malware binary and use that to decrypt the network communications and the botnet configuration information using HTTPS protocol, we can easily trace forensic information even if altered/ resisted by zeus.

One of my Guide is King in this area. I will ping u with more details when I get isoon by coming days.

thanks

Thnks Manish

Let me know if you have some papers on the same.

I appreciate 

The problem with takedowns of botnet command and control servers is partially a legal issue, since some internet service providers in some countries do not respond to such requests. Some of these may even profit from being a safe haven for cyber crime. It is also very much harder to stop the growth of a botnet than to grow one, since it is opportunistic and may only need one exploitable vulnerability to successfully infect new hosts, whereas to protect against such attacks all vulnerabilities must be covered. I do not think the sofistication of the attack tools is to blame, it is more the opportunity from huge amounts of poorly implemented or nonexisting cyber security.