I spent a bit of time thinking about this, and decided this is not off topic due to high interest and worry from list subscribers. Although I am looking wearily at Randy Bush, so I decided to mark it as OT: and max not send such things next time, although this is a rather rare case (publicly anyway). Matt Jonkman over at Bleeding-Snort wrote and released snort signatures, in cooperation with Joe Stewart at lurhq and myself at IL-CERT. I am sure many organizations would be interested in those. Let's hope non of you ever get to see these triggered. http://www.bleedingsnort.com/cgi-bin/viewcvs.cgi/Stable/VIRUS/TROJAN_Hotword?rev=1.1&view=auto alert tcp $EXTERNAL_NET any -> $HOME_NET 2any(msg:"BLEEDING-EDGE VIRUS Hotword Trojan in Transit"; content:"|63 6f 6d 66 69 64 65 6e 74 69 61 6c 20 64 6f 63 75 6d 65 6e 74 20 28 57 6f 72 64 29 20 66 72 6f 6d 20 44 69 67 69 44 6f 63 00 43 4d 20 25 73 20|"; flow:established,from_server; classtype:trojan-activity; reference:url,securityresponse.symantec.com/avcenter/venc/data/trojan.hotword.html; reference:url,securityresponse.symantec.com/avcenter/venc/data/trojan.rona.html; sid:2001959; rev:1;) alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"BLEEDING-EDGE VIRUS Hotword Trojan inbound via http"; content:"|63 6f 6d 66 69 64 65 6e 74 69 61 6c 20 64 6f 63 75 6d 65 6e 74 20 28 57 6f 72 64 29 20 66 72 6f 6d 20 44 69 67 69 44 6f 63 00 43 4d 20 25 73 20|"; flow:established,from_server; classtype:trojan-activity; reference:url,securityresponse.symantec.com/avcenter/venc/data/trojan.hotword.html; reference:url,securityresponse.symantec.com/avcenter/venc/data/trojan.rona.html; sid:2001960; rev:1;) alert tcp any any -> $EXTERNAL_NET 21 (msg:"BLEEDING-EDGE VIRUS Hotword Trojan -- Possible File Upload CHJO"; content:"STOR __"; content:"-CHJO.DRV"; within:100; nocase; classtype:trojan-activity; reference:url,securityresponse.symantec.com/avcenter/venc/data/trojan.hotword.html; reference:url,securityresponse.symantec.com/avcenter/venc/data/trojan.rona.html; sid:2001961; rev:1;) alert tcp any any -> $EXTERNAL_NET 21 (msg:"BLEEDING-EDGE VIRUS Hotword Trojan -- Possible File Upload CFXP"; content:"STOR __"; content:"-CFXP.DRV"; within:100; nocase; classtype:trojan-activity; reference:url,securityresponse.symantec.com/avcenter/venc/data/trojan.hotword.html; reference:url,securityresponse.symantec.com/avcenter/venc/data/trojan.rona.html; sid:2001962; rev:1;) alert tcp any any -> $EXTERNAL_NET 21 (msg:"BLEEDING-EDGE VIRUS Hotword Trojan -- Possible FTP File Request pspv.exe"; content:"SIZE pspv.exe"; classtype:trojan-activity; reference:url,securityresponse.symantec.com/avcenter/venc/data/trojan.hotword.html; reference:url,securityresponse.symantec.com/avcenter/venc/data/trojan.rona.html; sid:2001963; rev:1;) alert tcp any any -> $EXTERNAL_NET 21 (msg:"BLEEDING-EDGE VIRUS Hotword Trojan -- Possible FTP File Request .tea"; content:"LIST "; content:".tea"; nnocase; within:50; classtype:trojan-activity; reference:url,securityresponse.symantec.com/avcenter/venc/data/trojan.hotword.html; reference:url,securityresponse.symantec.com/avcenter/venc/data/trojan.rona.html; sid:2001964; rev:1;) alert tcp any any -> $EXTERNAL_NET 21 (msg:"BLEEDING-EDGE VIRUS Hotword Trojan -- Possible FTP File Status Upload ___"; content:"|53 54 4f 52 20 5f 5f 5f 0d 0a|"; classtype:trojan-activity; reference:url,securityresponse.symantec.com/avcenter/venc/data/trojan.hotword.html; reference:url,securityresponse.symantec.com/avcenter/venc/data/trojan.rona.html; sid:2001965; rev:1;) alert tcp any any -> $EXTERNAL_NET 21 (msg:"BLEEDING-EDGE VIRUS Hotword Trojan -- Possible FTP File Status Check ___"; content:"|53 49 5a 45 20 5f 5f 5f 0d 0a|"; classtype:trojan-activity; reference:url,securityresponse.symantec.com/avcenter/venc/data/trojan.hotword.html; reference:url,securityresponse.symantec.com/avcenter/venc/data/trojan.rona.html; sid:2001966; rev:1;) Gadi Evron.