TROJAN: ngrBot IRC Command and Control Activity

This signature detects the IRC Command and Control activity of the ngrBot, a malicious trojan. Users infected by this trojan can have their web traffic redirected and intercepted, which could lead to an exposure of sensitive data, like banking information. This trojan also has the ability to erase the boot sector of the hard drive, resulting in an unusable system. The source IP is infected and should be removed from the network for forensic analysis and malware removal.

References

URL: http://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Ngrbot-I.aspx

Short Name

TROJAN:NGRBOT-ACTIVITY

Severity

Critical

Recommended

False

Recommended Action

Drop

TROJAN: ngrBot IRC Command and Control Activity

References

Found a potential security threat?