Trojan/Backdoor - Arugizer Detection

High Nessus Network Monitor Plugin ID 5357

Synopsis

The remote host has been compromised and is running a 'Backdoor' program

Description

Arugizer backdoor activity has been detected. This indicates that a successful reply to a YES command sent to the Arugizer backdoor has been seen, which is a clear sign that the backdoor is installed and responding to commands.

Solution

Update your Antivirus and perform a full scan of the remote operating system.

See Also

http://www.kb.cert.org/vuls/id/154421

http://www.nessus.org/u?fba833e0

http://www.nessus.org/u?b341c9b0

Plugin Details

Severity: High

ID: 5357

Family: Backdoors

Published: 2010/03/09

Modified: 2016/01/19

Nessus ID: 45005, 45006

Risk Information

Risk Factor: High

CVSSv2

Base Score: 9.3

Temporal Score: 7.7

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:F/RL:OF/RC:C

CVSSv3

Base Score: 8.1

Temporal Score: 7.5

Vector: CVSS3#AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS3#E:F/RL:O/RC:C

Vulnerability Information

Vulnerability Publication Date: 2010/03/05

Exploitable With

Metasploit (Energizer DUO Trojan Code Execution)

Reference Information

CVE: CVE-2010-0103

BID: 38571