Tests for Nimda Worm infected HTML files

Your server appears to have been compromised by the Nimda mass mailing worm. It uses various known IIS vulnerabilities to compromise the server. SPDX-FileCopyrightText: 2001 Matt Moore Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right...

w32.spybot.fcd worm infection

The remote system is infected with a variant of the worm w32.spybot.fcd. SPDX-FileCopyrightText: 2004 jorge rodriguez Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Kibuv worm detection

A fake FTP server was installed by the KIBUV.B worm on this port. This worm uses known security flaws to infect the system. This machine may already be a SPDX-FileCopyrightText: 2005 Michel Arboi Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

Code Red X Worm Detection - Active Check

Your machine is infected with the SPDX-FileCopyrightText: 2001 SecuriTeam Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:microsoft:internetinformationservices";...

Kibuv worm detection

A fake FTP server was installed by the KIBUV.B worm on this port. This worm uses known security flaws to infect the system. This machine may already be a 'zombi' used by crackers to perform distributed denial of service...

Korgo worm detection

The remote host is probably infected with Korgo worm. It propagates by exploiting the LSASS vulnerability on TCP port 445 as described in Microsoft Security Bulletin MS04-011 and opens a backdoor on TCP ports 113 and 3067. SPDX-FileCopyrightText: 2004 David Maciejak Some text descriptions might b...

w32.spybot.fcd worm infection

The remote system is infected with a variant of the worm w32.spybot.fcd. Infected systems will scan systems that are vulnerable in the same subnet in order to attempt to spread. This worm also tries to do DDoS against targets in the Internet. OpenVAS Vulnerability Test $Id:...

CodeRed version X detection

Your machine is infected with the 'Code Red' worm. Your Windows system seems to be compromised. OpenVAS Vulnerability Test $Id: coderedx.nasl 8023 2017-12-07 08:36:26Z teissa $ Description: CodeRed version X detection Authors: Noam Rathaus Copyright: Copyright C 2001 SecuriTeam This program is fr...

Internet Security Systems Protection Advisory: Snort Back Orifice Parsing Remote Code Execution

Internet Security Systems Protection Advisory October 18, 2005 Snort Back Orifice Parsing Remote Code Execution Summary: ISS X-Force has discovered a remotely exploitable vulnerability in Snort’s Back Orifice pre-processor. A stack-based overflow can be triggered with a single UDP packet, allowin...

Zotob Worm Infection (Shell)

Binary data 3166.prm...

Zotob Worm Infection (FTP)

Binary data 3165.prm...

CVE-2004-2348

Sybari AntiGen for Domino 7.0 Build 722 SR2 allows remote attackers to cause a denial of service hang via an encrypted ZIP file with the "include full path info" option set, as used by certain variants of the Beagle/Bagle worm...

CVE-2004-2348

CVE-2004-2348 affects Sybari AntiGen for Domino 7.0 Build 722 SR2. The vulnerability allows remote attackers to cause a denial of service (hang) by processing an encrypted ZIP file with the “include full path info” option, as observed in variants of the Beagle/Bagle worm. The available documents ...

Zotob Worm Detection

A Microsoft Windows shell is running on port 8888. This may indicate an infection by the Zotob worm, although other worms may also create a shell on this port. C Tenable Network Security, Inc. include"compat.inc"; ifdescription scriptid19429; scriptversion"1.10"; scriptnameenglish:"Zotob Worm...

Zotob Worm Infection (Microsoft)

Binary data 3164.prm...

CVE-2005-1983

CVE-2005-1983 involves a stack-based buffer overflow in the Windows Plug and Play (PnP) service. Public details in connected sources describe a remote-code-execution vulnerability that can be triggered by a crafted PnP RPC packet, affecting Windows 2000 and Windows XP with SP1, and was notably ex...

CVE-2005-1983

Stack-based buffer overflow in the Plug and Play PnP service for Microsoft Windows 2000 and Windows XP Service Pack 1 allows remote attackers to execute arbitrary code via a crafted packet, and local users to gain privileges via a malicious application, as exploited by the Zotob aka Mytob worm...

CVE-2005-1983

Stack-based buffer overflow in the Plug and Play PnP service for Microsoft Windows 2000 and Windows XP Service Pack 1 allows remote attackers to execute arbitrary code via a crafted packet, and local users to gain privileges via a malicious application, as exploited by the Zotob aka Mytob worm...

VulnCheck KEV: CVE-2005-1983

Stack-based buffer overflow in the Plug and Play PnP service for Microsoft Windows 2000 and Windows XP Service Pack 1 allows remote attackers to execute arbitrary code via a crafted packet, and local users to gain privileges via a malicious application, as exploited by the Zotob aka Mytob worm...

Kibuv Worm Detection

The welcome message on this port matches the banner of a known backdoor. This is highly suspicious. The host is probably infected by a backdoor and is probably under the control of malicious attackers. C Tenable Network Security, Inc. include"compat.inc"; ifdescription scriptid18367; scriptversio...