A system has a distributed denial of service (DDOS) attack master, agent, or zombie installed, such as (1) Trinoo, (2) Tribe Flood Network (TFN), (3) Tribe Flood Network 2000 (TFN2K), (4) stacheldraht, (5) mstream, or (6) shaft.

The remote host appears to be running Trinity v3, a Trojan Horse that can be used to control your system or make it attack another network (this is  actually called a Distributed Denial Of Service attack tool).

It is very likely that this host has been compromised

The remote host appears to be running a mstream handler, which is a trojan that can be used to control your system or make it attack another network (this is actually called a distributed denial of service attack tool)

It is very likely that this host has been compromised

The remote host appears to be running a mstream agent, which is a trojan that can be used to control your system or make it attack another network (this is actually called a distributed denial of service attack tool)

It is very likely that this host has been compromised

The remote host appears to be running Shaft, which is a trojan that can be used to control your system or make it attack another network (this is actually called a distributed denial of service attack tool).

It is very likely that this host has been compromised

The remote host appears to be running Trin00 for Windows, a trojan that can be used to control your system or make it attack another network (this is actually called a distributed denial of service attack tool). 

It is very likely that this host has been compromised.

The remote host appears to be running Trin00, a Trojan Horse that can be used to control your system or make it attack another network (this is actually called a Distributed Denial Of Service attack tool).

It is very likely that this host has been compromised.

The remote host is running Stacheldraht, a trojan horse that can be used to control your system or make it attack another network.

An ICMP ECHO reply was sent to the remote host with 'gesundheit!' and an ID of 668. The host sent a reply with 'sicken ' and an ID of 669.

If Paranoid is enabled, the plugin will only check for the ICMP ECHO reply having ID 669.

It is very likely that this host has been compromised.

The remote host appears to be running TFN (Tribe Flood Network), which is a Trojan Horse that can be used to control your system or make it attack another network.

It is very likely that this host has been compromised

ID	Name	Product	Family	Severity
10501	Trinity v3 Trojan Detection	Nessus	Backdoors	critical
10391	mstream DDoS Handler Detection	Nessus	Backdoors	medium
10390	mstream DDoS Agent Detection	Nessus	Backdoors	medium
10350	Shaft Trojan Detection	Nessus	Backdoors	critical
10307	Trin00 for Windows Trojan Detection	Nessus	Backdoors	critical
10288	Trin00 Trojan Detection	Nessus	Backdoors	critical
10270	Stacheldraht Trojan Detection	Nessus	Backdoors	critical
10283	TFN (Tribe Flood Network) Trojan Detection	Nessus	Backdoors	critical

Detections

Analytics

CVE-2000-0138

high

Tenable Plugins

critical

medium

medium

critical

critical

critical

critical

critical