how to proceed when suspicious traffic is shown in the log?

[PIPIL]

hello there, i have a user thas that ckeckpoint firewall reports traffic from a user on " port_6667_trojants (6667).
I run symantec antivirus and never finds any virus.
my question is how to proceed to get rib of this traffic and if there is a way to find out what this tojan is doing to aou network?.

thanks.

 

[Piloria]

is the user using IRC?

 

[PIPIL]

well thats the case, it mightme hiden because i don't see IRC installed on his PC.

 

[Piloria]

look at the destination of the connection.
run it via

http://www.samspade.org

and find some info out about it.