Stacheldraht Trojan Detection

The remote host is running Stacheldraht, a trojan horse that can be used to control your system or make it attack another network. An ICMP ECHO reply was sent to the remote host with 'gesundheit!' and an ID of 668. The host sent a reply with 'sicken ' and an ID of 669. If Paranoid is enabled, the...

CVE-1999-1084

The "AEDebug" registry key is installed with insecure permissions, which allows local users to modify the key to specify a Trojan Horse debugger which is automatically executed on a system crash...

TFN (Tribe Flood Network) Trojan Detection

The remote host appears to be running TFN Tribe Flood Network, which is a Trojan Horse that can be used to control your system or make it attack another network. It is very likely that this host has been compromised C Tenable Network Security, Inc. include"compat.inc"; if description scriptid1028...

Finjan_Exploit_Alert.txt

Finjan Software, Inc. Malicious Code Exploit Alert Finjan customers and partners, There is a recent Trojan executable you should be aware of called WinNT.Infis. Through Finjan's proactive "sandbox" technology, executable files such as the WinNT.Infis are monitored and blocked on the first attack...

CVE-1999-1350

ARCAD Systemhaus 0.078-5 installs critical programs and files with world-writeable permissions, which could allow local users to gain privileges by replacing a program with a Trojan horse...

portmap.txt

Subject: portmap.c Trojan To: [email protected] Trojan being spread to clueless kiddies, claims to exploit portmap on Redhat boxes, really adds a rootshell to your inetd.conf file and sends other info like your ip address by executing ifconfig, it sends this mail to [email protected] Co...

linux_stealth_module.txt

Subject: yet another article about stealth modules in linux. To: [email protected] abtrom: anti btrom .................. Preface: ........ I've seen many stealth modules for Linux. New ways of of hiding the modules are found, so the 'lsmod' cant find them, etc, etc. But the problem is tha...

cassandra.txt

Subject: Trojan Horse Guard - Cassandra GOLD Release. To: [email protected] Uppsala, Sweden the 23rd of July 1999 Dear fellow Bugtraq readers, I am proud to present the Gold version of Cassandra. Cassandra is a free Trojan Horse Guard which has the ability to detect and remove 25 differen...

Microsoft Windows NT 4.0SP1SP2SP3SP4SP5 - RASMAN Privilege Escalation

Microsoft Windows NT 4.0SP1SP2SP3SP4SP5 - RASMAN Privilege Escalation source: https://www.securityfocus.com/bid/645/info Any authenticated NT user ie domain user can modify the pathname for the RASMAN binary in the Registry. The next time the RAS Service is started, the trojan service referenced ...

Microsoft Windows NT 4.0/SP1/SP2/SP3/SP4/SP5 - RASMAN Privilege Escalation

source: https://www.securityfocus.com/bid/645/info Any authenticated NT user ie domain user can modify the pathname for the RASMAN binary in the Registry. The next time the RAS Service is started, the trojan service referenced by the RASMAN pathname will be executed with system privileges. This...

retina.vs.iis4-round2-the.exploit.txt

http://www.eeye.com/database/advisories/ad06081999/ad06081999-exploit.html Retina vs. IIS4, Round 2 - The Exploit We contemplated releasing this exploit and decided to do it. Here Is Why. We are a full disclosure security team, and we were not working under any non disclosure agreements with...

adobe.acrobat.netbus.trojan.txt

Date:Tue, 6 Apr 1999 07:41:06 -0600 Reply-To:"Wamsley, James R" Sender:Windows NT BugTraq Mailing List From:"Wamsley, James R" Subject:Adobe put Trojan horse in Acrobat. Comments:To: "[email protected]" Comments:cc: "Samos, Randy B." We recently found an alarming problem with Adobe's...

trojan-backdoor-ftp.win.tue.nl.txt

Date: Sun, 24 Jan 1999 09:03:42 -0500 From: Trevor Johnson To: [email protected] Subject: Re: util-linux compromised I just received the following letter: Date: Sun, 24 Jan 1999 04:01:55 -0500 EST From: John Stange Subject: util-linux compromised? I grabbed util-linux-2.9g yesterday from...

tcp_wrappers-CERT.txt

Date: Fri, 22 Jan 1999 20:12:36 -0500 From: Eric To: [email protected] Subject: CERT Advisory CA-99.01 - TCP Wrappers Trojan Horse fwd Date: Fri, 22 Jan 1999 16:42:00 -0500 Message-Id: From: CERT Advisory To: [email protected] Subject: CERT Advisory CA-99.01 - TCP Wrappers Trojan Hor...

ie0199.exe-trojan.txt

Date: Thu, 28 Jan 1999 20:12:39 -0500 From: Mark E. Duck To: [email protected] Subject: E-mailed Trojan There is a trojan horse circulating the Internet as an attachment in email with a spoofed email address of Microsoft Corporation. It contains an announcement and an attachment that is...

nt.case.symbolic.txt

Date: Fri, 12 Mar 1999 13:03:57 -0700 From: Mark To: [email protected] Subject: ALERT Case Sensitivity and Symbolic Links Prasad Dabak of Cybermedia Software Private Limited has discovered yet another security risk in Windows NT involving the operating system's case sensitivity...

promail.1.21.trojan.txt

Date: Fri, 19 Mar 1999 09:41:18 +0100 From: Aeon Labs To: [email protected] Subject: security/privacy news Perhaps this might be of interest to Your readers. ProMail v1.21, an advanced freeware mail program spread through several worldwide distribution networks SimTel.net, Shareware.co...

Microsoft Windows NT 4.0SP 1SP 2Sp 3SP 4SP 5 - Malformed Dialer Entry

Microsoft Windows NT 4.0SP 1SP 2Sp 3SP 4SP 5 - Malformed Dialer Entry // source: https://www.securityfocus.com/bid/554/info Dialer.exe has an unchecked buffer in the part of the program that reads dialer entries from %systemroot%\dialer.ini. A specially-formed entry could cause arbitrary code to ...

BackOrifice Software Detection

The remote host seems to be running BackOrifice 1.x with no password. BackOrifice is a trojan which allows an intruder to take control of the remote computer. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid10024;...

Portal of Doom Backdoor Detection

Portal of Doom is installed. This backdoor allows anyone to partially take the control of the remote system. An attacker may use it to steal your password or prevent your from working properly. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...