Signature Detail

TROJAN: NetBus Pro Server Response

This signature detects TCP packets sent from local server port 20034 to a remote port. This can indicate the system is responding to a Netbus Pro user. NetBus Pro, a remote administration tool based on the Trojan NetBus, allows users to access data on remote Microsoft Windows systems. NOTE: NetBus Pro is a legitimate remote administration tool and all actions are visible to the server.

Extended Description

Trojan NetBus Pro enables an attacker to take complete remote control of an infected system.

References

• CVE: CVE-1999-0660
• URL: http://www.all-internet-security.com/netbus_trojan.html
• URL: http://www.juniper.net/security/auto/vulnerabilities/vuln64.html
• URL: http://www.windowsecurity.com/pages/article.asp?id=453