The Cart32 e-commerce shopping cart is installed. This software contains multiple security flaws.

There is a backdoor password of 'wemilo' in cart32.exe. This backdoor allows a remote attacker to run arbitrary commands in the context of the web server, and access credit card information.

Additionally, it may be possible to change the administrator password by going directly to :

/c32web.exe/ChangeAdminPassword

The remote host appears to be running a mstream handler, which is a trojan that can be used to control your system or make it attack another network (this is actually called a distributed denial of service attack tool)

It is very likely that this host has been compromised

The remote host appears to be running a mstream agent, which is a trojan that can be used to control your system or make it attack another network (this is actually called a distributed denial of service attack tool)

It is very likely that this host has been compromised

The script /cart/cart.cgi is present.

If this shopping cart system is the Dansie Shopping Cart, and if it is older than version 3.0.8 then it is very likely that it contains a backdoor that allows anyone to execute arbitrary commands on this system.

The remote host appears to be running Shaft, which is a trojan that can be used to control your system or make it attack another network (this is actually called a distributed denial of service attack tool).

It is very likely that this host has been compromised

The remote host appears to be running Trin00 for Windows, a trojan that can be used to control your system or make it attack another network (this is actually called a distributed denial of service attack tool). 

It is very likely that this host has been compromised.

The remote host appears to be running CDK, a backdoor that can be used to control your system.  This suggests the host has been been compromised.

A remote attacker can control the system by connecting to this port and sending the password 'ypi0ca'.

Kuang2 the Virus was found.

Kuang2 the Virus is a program that infects all the executables on the system, as well as set up a server that allows the remote control of the computer.  The client program allows files to be browsed, uploaded, downloaded, hidden, etc on the infected machine.  The client program can also execute programs on the remote machine.

Kuang2 the Virus also has plugins that can be used that allows the client to do things to the remote machine, such as hide the icons and start menu, invert the desktop, pop up message windows, etc.

The remote host appears to be running Trin00, a Trojan Horse that can be used to control your system or make it attack another network (this is actually called a Distributed Denial Of Service attack tool).

It is very likely that this host has been compromised.

SyGate engine remote controller seems to be running on this port. It may be used by malicious users that are on the same subnet as this host to reconfigure the remote SyGate engine.

The remote host is running Stacheldraht, a trojan horse that can be used to control your system or make it attack another network.

An ICMP ECHO reply was sent to the remote host with 'gesundheit!' and an ID of 668. The host sent a reply with 'sicken ' and an ID of 669.

If Paranoid is enabled, the plugin will only check for the ICMP ECHO reply having ID 669.

It is very likely that this host has been compromised.

WinSATAN is installed.  This backdoor allows anyone to partially take control of the remote system.  An attacker may use it to steal your password or prevent your system from working properly.

The remote host appears to be running TFN (Tribe Flood Network), which is a Trojan Horse that can be used to control your system or make it attack another network.

It is very likely that this host has been compromised

NetBus 2.x is installed.

NetBus is a remote administration tool that can be used for malicious purposes, such as sniffing what the user is typing, its passwords and so on.

An attacker may have installed it to control hosts on your network.

Furthermore, Netbus authentication may be bypassed.

NetBus 1.x is installed.

NetBus is a remote administration tool that can be used for malicious purposes, such as sniffing what the user is typing, its passwords and so on. 

An attacker may have installed it to control hosts on your network. 

Furthermore, Netbus authentication may be bypassed.

The remote host seems to be running BackOrifice 1.x with no password. BackOrifice is a trojan which allows an intruder to take control of the remote computer.

Portal of Doom is installed. 

This backdoor allows anyone to partially take the control of the remote system.

An attacker may use it to steal your password or prevent your from working properly.

The remote host has the GirlFriend backdoor installed. This backdoor allows anyone to partially take control of the remote system. An attacker could use it to steal your password or prevent your system from working properly.

The remote host has the backdoor GateCrasher installed. This backdoor allows anyone to partially take control of the affected system. An attacker may use it to steal information or crash the affected host.

DeepThroat is installed on the remote host.  This backdoor allows anyone to perform actions such as reading files, reading the registry and executing programs.  A remote attacker could use this to completely control the system.

The NetSphere backdoor is installed on the remote host.  By connecting to it, a remote attacker can gain control of the affected system.

There is a backdoor in the old FTP daemons of Linux that allows remote users to log in as 'NULL' with password 'NULL'. These credentials provide root access.

The remote finger daemon seems to be a backdoor, as it seems to react to the request :

 cmd_rootsh@target

If a root shell has been installed as /tmp/.sh, then this finger daemon is definitely a trojan, and this system has been compromised.

ID	Name	Severity
10389	Cart32 Backdoor Password Arbitrary Command Execution	high
10391	mstream DDoS Handler Detection	medium
10390	mstream DDoS Agent Detection	medium
10368	Dansie Shopping Cart Backdoor Detection	critical
10350	Shaft Trojan Detection	critical
10307	Trin00 for Windows Trojan Detection	critical
10036	CDK Backdoor Detection	critical
10132	Kuang2 the Virus Detection	critical
10288	Trin00 Trojan Detection	critical
10274	SyGate Backdoor Detection	high
10270	Stacheldraht Trojan Detection	critical
10316	WinSATAN Backdoor Detection	high
10283	TFN (Tribe Flood Network) Trojan Detection	critical
10152	NetBus 2.x Software Detection	high
10151	NetBus 1.x Software Detection	high
10024	BackOrifice Software Detection	critical
10186	Portal of Doom Backdoor Detection	critical
10094	GirlFriend Backdoor Detection	critical
10093	GateCrasher Backdoor Detection	critical
10053	DeepThroat Backdoor Detection	critical
10005	NetSphere Backdoor Detection	critical
10080	Linux FTP Server Backdoor Detection	critical
10070	Finger Backdoor Detection	critical

Detections

Analytics

Backdoors Family for Nessus

high

medium

medium

critical

critical

critical

critical

critical

critical

high

critical

high

critical

high

high

critical

critical

critical

critical

critical

critical

critical

critical