Signature Detail

TROJAN: Infector Client Request

This signature detects TCP packets sent from remote port 1000:1300 to local server port 146. This can indicate an attacker is scanning the system for the Trojan Infector. Infector, a remote administration Trojan similar to Back Orifice, allows attackers to access data and gain control over some functions on remote Microsoft Windows systems.

Extended Description

If installed on a machine, the Infector Trojan enables an attacker to take control of the target host and notifies the attacker through an ICQ message.

References

• CVE: CVE-1999-0660
• URL: http://nvd.nist.gov/nvd.cfm?cvename=CVE-1999-0660
• URL: http://www.securityspace.com/smysecure/catid.html?ctype=cve&id=CVE-1999-0660