Signature Detail

TROJAN: Infector Server Response

This signature detects TCP packets sent from local server port 146 to remote port 1000:1300. This can indicate the system is responding to an attacker confirming successful installation of the Trojan Infector. Infector, a remote administration Trojan similar to Back Orifice, allows attackers to access data and gain control over some functions on remote Microsoft Windows systems.

Extended Description

Infector is a Trojan that infects Microsoft Windows operating systems. It enables an attacker to take control of the target host, and notifies the attacker by an ICQ message.

References

• CVE: CVE-1999-0660
• URL: http://www.pestpatrol.com/PestInfo/I/Infector.asp
• URL: http://secunia.com/virus_information/905