Signature Detail

TROJAN: SubSeven 2.2 Server Response

This signature detects TCP packets sent from local server port 27374 to a remote system. This can indicate the server is responding to an attacker to confirm access to the Trojan SubSeven v2.2. SubSeven, a remote administration Trojan, allows attackers to access data and gain control over some functions on remote Microsoft Windows systems.

Extended Description

SubSeven is a backdoor Trojan that infects vulnerable Windows operating systems. It enables remote attackers to take control of the infected host.

References

• CVE: CVE-1999-0660
• URL: http://www.hackfix.org/subseven/
• URL: http://www.f-secure.com/v-descs/subseven.shtml
• URL: http://secunia.com/virus_information/1125