Signature Detail

TROJAN: GirlFriend Server Response

This signature detects the message "GirlFriend" sent from local TCP port 21554 to a remote port. This can indicate the system is responding to an attacker attempting to remotely control the system using Trojan GirlFriend. GirlFriend, a remote administration Trojan similar to Back Orifice, allows attackers to access data and gain control over some functions on remote Microsoft Windows systems.

Extended Description

GirlFriend is a remote administration tool that enables remote attackers to control an infected machine.

References

• CVE: CVE-1999-0660
• URL: http://www.juniper.net/security/auto/vulnerabilities/vuln529.html
• URL: http://www.glocksoft.com/trojan_list/GirlFriend.htm