Signature Detail
Short Name |
SCAN:MISC:SVR-RES-S1024 |
|---|---|
Severity |
Info |
Recommended |
No |
Category |
SCAN |
Release Date |
2003/04/22 |
Update Number |
1213 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
TROJAN: Infector Server Response (Port 1024)
This signature detects TCP packets sent from local server port 146 to remote port 1024. This can indicate the system is responding to an attacker to confirm successful installation of the Trojan Infector. Infector, a remote administration Trojan similar to Back Orifice, allows attackers to access data and gain control over some functions on remote Microsoft Windows systems.
Extended Description
None
References