Signature Detail

TROJAN: Phoenix Initial Server Response

This signature detects the initial server response from a Phoenix backdoor Trojan. Detecting this response indicates that your system is infected with the Phoenix backdoor Trojan. Using the Phoenix client, attackers can gain unauthorized access to the host computer and execute malicious operations.

Extended Description

Phoenix is a remote administration tool. It enables remote attackers to control an infected machine.

References

• CVE: CVE-1999-0660
• URL: http://securityresponse.symantec.com/avcenter/venc/data/backdoor.phoenix.html
• URL: http://secunia.com/virus_information/2602
• URL: http://www.pestpatrol.com/pestinfo/b/backdoor_phoenix.asp