This SMTP server is running on a non-standard port.  This might be a backdoor set up by attackers to send spam or even control of a targeted machine.

The welcome message on this port matches the banner of a known backdoor.  This is highly suspicious.  The host is probably infected by a backdoor and is probably under the control of malicious attackers.

A TFTP server is running on this port.  However, while trying to fetch a random file, we got an executable file. 

Many worms are known to propagate through TFTP.  This is probably a backdoor.

TCP port 0 is open on the remote host. This is highly suspicious as this TCP port is reserved and should not be used. This might be a backdoor (REx).

The remote host seems to have been infected with the Bofra worm or one of its variants, which infects machines via an Internet Explorer IFRAME exploit.  It is very likely this system has been compromised.

The system is infected by the MoonLit virus, the backdoor port is open.

Backdoor.Moonlit is a Trojan horse program that can download and execute files, and may act as a proxy server.

The account 'bash' has no password set. An attacker may use it to gain further privileges on this system. 

This account was likely created by a backdoor installed by a fake Linux RedHat patch.

The remote host seems to be running a copy of a trojaned version of the 'PostNuke' content management system.

PostNuke is a content management system in PHP whose main website has been compromised between the 24th and 26th of October 2004. An attacker modified some of the source code of the tool to execute arbitrary commands remotely on the remote host, by passing arguments to the 'oops' parameter of the file pnAPI.php.

The remote system is infected with a variant of the worm w32.spybot.fcd.  Infected systems will scan systems that are vulnerable in the same subnet in order to spread, creating a botnet that has been used for purposes such as DDoS attacks.

The remote host is running the Hacker Defender rootkit. Among other things, it hooks itself into all open TCP ports on the system, listening for a specially crafted packet, and opening a backdoor on that port when found. This backdoor can be used by malicious users to control the affected host remotely.

This host appears to be running Unmanarc Remote Control Server (URCS). While it does have some legitimate uses, URCS may also have been installed silently as a backdoor, which may allow an intruder to gain remote access to files on the remote system.  If this program was not installed for remote management, then it means the remote host has been compromised. 

An attacker may use it to steal files, passwords, or redirect ports on the remote system to launch other attacks.

This host seems to be running an ident server, but the ident server responds to an empty query with a random userid.  This behavior may be indicative of an IRC bot, worm and/or virus infection. It is very likely this system has been compromised.

The remote host is running radmin - a remote administration tool - on port 10002. 

This indicates that an attacker may have exploited one of the flaws described in MS04-028 with a widely available exploit. 

As a result, anyone may connect to the remote host and gain control by logging into the remote radmin server.

It was possible to log into the remote host with the login 'X' and a blank password. 

A widely available exploit, using one of the vulnerabilities described in the Microsoft Bulletin MS04-028 creates such an account.  This probably means that the remote host has been compromised by the use of this exploit.

The backdoor 'BackDoor.Zincite.A' is installed on the remote host. It has probably been installed by the 'MyDoom.M' virus.  This backdoor may allow an attacker to gain unauthorized access on the remote host.

Download.Ject is a Trojan that infects Microsoft IIS servers.

The Trojan's dropper sets it as the document footer for all pages served by IIS Web sites on the infected computer.

The W32.Dabber worm is listening on this port. W32.Dabber propagates by exploiting a vulnerability in the FTP server component of W32.Sasser.Worm and its variants.

It installs a backdoor on infected hosts and tries to listen on port 9898. If the attempt fails, it tries to listen on ports 9899 through 9999 in sequence until it finds an open port.

Nessus found that TCP ports 113 and 3067 are open.
The Korgo worm is known to open a backdoor on these ports.
It propagates by exploiting the LSASS vulnerability on TCP port 445 (as described in Microsoft Security Bulletin MS04-011)

** Note that Nessus did not try to talk to the backdoor,
** so this might be a false positive.

The Sasser worm is infecting this host.  Specifically, a backdoored command server may be listening on port 9995 or 9996 and an ftp server (used to load malicious code) is listening on port 5554 or 1023.  There is every indication that the host is currently scanning and infecting other systems.

The remote host has the Agobot.FO backdoor installed.  This backdoor is known to:

  - Scan local networks for common Microsoft     vulnerabilities.

  - Scan local networks for exploitable DameWare systems.

  - Brute force local Microsoft machine User accounts.

  - Connect to an IRC channel and setup a BOT for remote     command execution.

The remote systems appears to have PhatBOT installed. This program allows the machine to be controlled via a P2P network. PhatBOT is extremely sophisticated and allows the remote attacker to use the victim machine to perform various actions.

The remote host has the Bagle.B worm installed. This is a variant of the Bagle worm which spreads via email and has a backdoor that listens on port 8866.

The MyDoom backdoor is listening on this port. An attacker may connect to it to retrieve sensitive information, e.g. passwords or credit card numbers.

The remote host had the Bagle worm installed. Nessus attempted to remove it by connecting to port 6777 of the host and using the built-in removal command.  However, you should verify that :

- The worm was removed properly

- The remote host has not been altered in any other way.

The remote host is using the NCASE program. You should ensure that:\n
- the user intended to install NCASE (it is sometimes silently installed) - the use of NCASE matches your corporate mandates and security policies.

Running an anti-spyware application will typically remove this software.

The remote host is using the DOWNLOADWARE program. You should ensure that: - the user intended to install DOWNLOADWARE (it is sometimes silently installed) - the use of DOWNLOADWARE matches your corporate mandates and security policies.

To remove this sort of software, you may wish to check out ad-aware or spybot.

Cydoor Desktop Media, an adware program, is installed on the remote host. This program displays pop-up/pop-under advertisements and changes web browser settings (e.g., homepage) without the user's permission.

The remote host is using the VCATCH program. You should ensure that :

- the user intended to install VCATCH (it is sometimes     silently installed)
    - the use of VCATCH matches your corporate mandates and     security policies.

To remove this sort of software, you may wish to check out ad-aware or spybot.

The remote host is using the TIMESINK program. You should ensure that :

  - the user intended to install TIMESINK (it is sometimes     silently installed)
    - the use of TIMESINK matches your corporate mandates     and security policies.

To remove this sort of software, you may wish to check out Ad-Aware or Spybot.

This host appears to be running Wollf on this port. Wollf Can be used as a Backdoor which allows an intruder gain remote access to files on your computer. If you did not install this program for remote management then this host may be compromised.

An attacker may use it to steal your passwords, or redirect ports on your system to launch other attacks

This host appears to be running Fluxay Sensor on this port. 

Fluxay Sensor is a backdoor that allows an intruder to gain remote access to files on your computer.  Similar to SubSeven, this program installs as a service and is password protected to make it difficult to stop or remove it. 

An attacker may use this backdoor to steal passwords from the remote host or use it in other attacks.

This host appears to be running RemoteNC on this port

RemoteNC is a Backdoor which allows an intruder gain remote control of your computer.

An attacker may use it to steal your passwords.

This host appears to be running FsSniffer on this port.

FsSniffer is backdoor which allows an intruder to steal PoP3/FTP and other passwords you use on your system.

An attacker may use it to steal your passwords.

It was possible to log into the remote host with the login 'e' and the password 'asd#321'.
A widely available exploit, using one of the vulnerabilities described in the Microsoft Bulletin MS03-039 creates such an account. This probably means that the remote host has been compromised by the use of this exploit.

The BugBear.B backdoor appears to be listening on this port.  An attacker may connect to it to retrieve secret information such as passwords, credit card numbers, etc. 

The BugBear.B worm includes a keylogger and can kill antivirus and firewall software.  It propagates through email and open Windows shares.

The remote host is running a Desktop Orbiter Satellite

As this service is unpassworded, an attacker may connect to it to reboot the remote host or take administrative control over it.

Your system seems to be infected by the Bugbear.B virus (its backdoor has been detected on port 81).

The remote host is running a Desktop Orbiter Satellite.

This service could be used by an attacker to partially take control of the remote system, as it is not password protected.

The remote host seems to be infected with the 'lovgate' virus which opens a command prompt shell on this port.

The backdoor software '4553' seems to be installed on this host, which indicates it has been compromised.

An unknown service was found running on this port. Trojan Horses and other malware may sometimes open these ports to allow remote access to the machine.

Ensure that this port is intended to be open and controlled by legitimate software installed by the administrator.

The BugBear backdoor is listening on this port.  An attacker may connect to it to retrieve secret information such as passwords, credit card numbers, etc.

The BugBear worm includes a keylogger and can kill antivirus and firewall software.  It propagates through email and open Windows shares.

Depending on the antivirus vendor, it is known as Tanatos, I-Worm.Tanatos, NATOSTA.A, W32/Bugbear-A, Tanatos, W32/Bugbear@MM, WORM_BUGBEAR.A, Win32.BugBear...

Radmin (Remote Administrator), a popular remote control software application for Windows, is running on this port. 

Make sure that a strong password is used, otherwise an attacker may brute-force it and control the machine.

alya.cgi was found on the remote system. This script is likely a CGI based backdoor distributed with multiple rootkits.

One or more files were found on this host that indicate a possible compromise.

The RemotelyAnywhere SSH server is running on this system. According to NAVCIRT, attackers target this management tool.

A RemotelyAnywhere WWW server is running on the remote host. According to NAVCIRT, attackers use this management tool as a backdoor.

This host seems to be infected by the lion worm, because it has root shells running on extra ports and a copy of SSH running on port 33568.

The remote host appears to be running Trinity v3, a Trojan Horse that can be used to control your system or make it attack another network (this is  actually called a Distributed Denial Of Service attack tool).

It is very likely that this host has been compromised

This host seems to be running SubSeven on this port.
SubSeven is a Trojan Horse which allows an intruder to take the control of the remote computer.

An attacker may use it to steal your passwords, modify your data, and preventing you from working properly.

ID	Name	Severity
18391	SMTP Server Non-standard Port Detection	medium
18367	Kibuv Worm Detection	critical
18263	TFTP Backdoor Detection	critical
18164	TCP Port 0 Open: Possible Backdoor	info
15746	Microsoft IE FRAME/IFRAME/EMBED Tag Overflow (Bofra Worm Detection)	critical
15586	MoonLit Virus Backdoor Detection	critical
15583	Unpassworded 'bash' Backdoor Account	critical
15570	PostNuke Trojaned Distribution	high
15520	w32.spybot.fcd Worm Infection Detection	high
15517	Hacker Defender Backdoor Detection	critical
15405	Unmanarc Remote Control Server (URCS) Detection	critical
14841	IRC Bot ident Server Detection	critical
14834	Radmin (Remote Administrator) Port 10002 - Possible GDI Compromise	high
14818	MS04-028 Exploitation Backdoor Account Detection	high
14184	Zincite.A (MyDoom.M) Backdoor Detection	critical
12287	Microsoft IIS Download.Ject Trojan Detection	high
12266	W32.Dabber Worm Detection	critical
12252	Korgo Worm Detection	critical
12219	Sasser Virus Detection	high
12128	Agobot.FO Backdoor Detection	critical
12111	PhatBOT Backdoor Detection	critical
12063	Bagle.B Worm Detection	high
12029	MyDoom Virus Backdoor Detection	critical
12027	Bagle Worm Removal	critical
12017	NCASE Software Detection	high
12013	DOWNLOADWARE Software Detection	high
12012	CYDOOR Software Detection	medium
12004	VCATCH Spyware Detection	high
12003	TIMESINK Spyware Detection	high
11881	Wollf Backdoor Detection	critical
11880	Fluxay Sensor Detection	critical
11855	RemoteNC Backdoor Detection	critical
11854	FsSniffer Backdoor Detection	high
11839	MS03-039 Exploitation Backdoor Account Detection	critical
11733	Bugbear.B Worm Detection	critical
11713	Desktop Orbiter Unpassworded Access Remote Reboot DoS	critical
11707	Bugbear.B Web Backdoor Detection	critical
11691	Desktop Orbiter Server Detection	high
11633	Lovgate Virus Detection	critical
11187	4553 Parasite Mothership Backdoor Detection	critical
11157	Trojan Horse Detection	medium
11135	Bugbear Worm Detection	critical
11123	Radmin (Remote Administrator) Port 4899 Detection	info
11118	alya.cgi CGI Backdoor Detection	high
11003	Microsoft IIS Potentially Compromised Host Detection	critical
10921	RemotelyAnywhere SSH Detection	info
10920	RemotelyAnywhere WWW Detection	info
10646	Lion Worm Detection	critical
10501	Trinity v3 Trojan Detection	critical
10409	SubSeven Trojan Detection	critical

Detections

Analytics

Backdoors Family for Nessus

medium

critical

critical

info

critical

critical

critical

high

high

critical

critical

critical

high

high

critical

high

critical

critical

high

critical

critical

high

critical

critical

high

high

medium

high

high

critical

critical

critical

high

critical

critical

critical

critical

high

critical

critical

medium

critical

info

high

critical

info

info

critical

critical

critical