Trojan Horse Client Detection

critical Nessus Network Monitor Plugin ID 4477

Synopsis

The remote host has been compromised and is running a 'backdoor' program.

Description

The remote client appears to be infected by a Trojan horse. NNM had determined this based on the outbound connections recently made to control servers. NNM just observed the host attempting to connect to importtrenz -dot- com.

Solution

Manually check system integrity and remove any malicious code or processes that may reside on the system.

See Also

http://www.secureworks.com/research/blog/index.php/2007/06/18/detecting-bbb-irs-ftc-proforma-trojan-infected-users-on-your-network

Plugin Details

Severity: Critical

ID: 4477

Family: Backdoors

Published: 4/20/2008

Updated: 1/16/2019