Signature Detail

TROJAN: RaTHeaD Initial Server Response

This signature detects the initial response from a RaTHeaD Trojan server. Detecting this response indicates that your system is infected with this Trojan. A successful attacker can gain control of your system.

Extended Description

RaTHead is a remote administration tool. It enables remote attackers to completely control an infected machine.

References

• CVE: CVE-1999-0660
• URL: http://www.glocksoft.com/trojan_list/Rathead.htm
• URL: http://www.pestpatrol.com/pestinfo/r/rathead_2_01.asp
• URL: http://securityresponse.symantec.com/avcenter/nis_ids/s20227.html