We will cover research on new ways operators and end users can fight bots after the infection including an automated forensics system that finds clues and timelines of user activity during infection, helping recovery from keyloggers and banking trojans. These new technologies can provide us with recovery tools from situations that previously required a complete wipe and rebuild of the system.