Signature Detail

TROJAN: DonaldDick Server Response

This signature detects the message "pINg" within a server response sent from local TCP port 23476 to a remote port. This can indicate the system is responding to an attacker who is attempting to use the Trojan DonaldDick to remotely control the system. DonaldDick, a remote administration Trojan similar to Back Orifice, allows attackers to access data and gain control over some functions on remote Microsoft Windows systems.

Extended Description

DonaldDick is a remote administration tool. It enables remote attackers to gain control over an infected machine.

References

• CVE: CVE-1999-0660
• URL: http://www.sophos.com/virusinfo/analyses/trojdonalddick.html
• URL: http://www.megasecurity.org/trojans/d/donalddick/Donalddick_all.html
• URL: http://www.spywareguide.com/product_show.php?id=967