Sophos botnet

[neonetman]

I’m repeatedly receiving the following Advanced Threat Protection C&C reports from my Sophos UTM, all referencing to one of my domain controllers. Some of the alerts are identifying C2/Generic, whilst others are reporting dubious DNS queries to a lock.bz domain or a .tk domain

 

 

Threat name....: C2/Generic-A

Details........: http://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/C2~Generic-A.aspx

Time...........: 2016-11-08 08:50:23

Traffic blocked: yes

 

 

I’ve run a SAV scan, run the Sophos virus removal tool, and checked our DNS server for references, with nothing appearing. I’m not receiving reports for our other DNS server (which is replicated through AD), so am at a loss to identify this issue.

 

Can anyone help on this?

 

 

 

 

 

Can you please advise

[Jobos]

I've had something similar to that and reporting an infected host with C2/Generic . Searching the web filter logs at both of my schools that use Sophos UTM I'm finding a shed load of block entries for symcb.com

 

Please see link below. I'm reimaging the machine just in case but I'm 50/50 as to it having any infection in the first place.

 

http://www.edugeek.net/forums/security/176435-strange-file-downloads.html