Signature Detail

TROJAN: Ghost Server Response

This signature detects the initial server response from a Ghost Trojan server. Detecting this response indicates that your system is infected with the Ghost backdoor Trojan. Using the Ghost client, attackers can gain unauthorized access to the host computer and execute malicious operations.

Extended Description

Ghost allows remote attackers to have unauthorized control and access to an infected system.

References

• CVE: CVE-1999-0660
• URL: http://securityresponse.symantec.com/avcenter/venc/data/backdoor.ghost.html
• URL: http://www.sophos.com/virusinfo/analyses/trojghostspy.html
• URL: http://www3.ca.com/securityadvisor/pest/pest.aspx?id=24108