Signature Detail

TROJAN: SubSeven 2.1A Server Response

This signature detects the string "connected" within a TCP packet sent from local server port 16959 to a remote system. This can indicate the server is responding to an attacker to confirm access to the Trojan SubSeven v2.1. SubSeven, a remote administration Trojan, allows attackers to access data and gain control over some functions on remote Microsoft Windows systems.

Extended Description

SubSeven is a backdoor Trojan that infects vulnerable Windows operating systems. It enables remote attackers to take control of the infected host.

References

• CVE: CVE-1999-0660
• URL: http://secunia.com/virus_information/1125
• URL: http://www3.ca.com/securityadvisor/pest/pest.aspx?id=5802
• URL: http://www.symantec.com/avcenter/venc/data/backdoor.subseven.html