The remote web server may have been infected with a malicious script tag.  These tags usually point to a malicious site that is hosting code designed to subvert the security of the client machine.

The remote client appears to be infected by a Trojan horse.  NNM had determined this based on the outbound connections recently made to control servers. 

The remote client appears to be infected by a Trojan horse.  NNM had determined this based on the outbound connections recently made to control servers.  NNM just observed the host attempting to connect to importtrenz -dot- com.

The remote port seems to be sending the payload of a malware. This is used by malware when spreading by infecting other hosts.  The system is probably infected by a worm or a Trojan horse.

The remote web server may have been infected with a malicious 'IFRAME' tag.  These tags usually point to a malicious site that is hosting code designed to subvert the security of the client machine.  

The remote host appears to be running a machine that is a server within a botnet network.  A botnet is a network of compromised computers that are remotely controlled by a malicious bot administrator.  Botnets are commonly used for
sending spam
running Denial of Service (DoS) attacks against other networks
scanning and compromising new systems
installing sniffers
installing keyloggers
identify theft 



The remote host appears to be running a machine that is being used to control a botnet.  A botnet is a network of compromised computers that are remotely controlled by a malicious bot administrator.  Botnets are commonly used for
sending spam
running Denial of Service (DoS) attacks against other networks
scanning and compromising new systems
installing sniffers
installing keyloggers
identify theft


The remote host appears to be running a machine that has been compromised and is being controlled by a botnet.  A botnet is a network of compromised computers that are remotely controlled by a malicious bot administrator.  Botnets are commonly used for
sending spam
running Denial of Service (DoS) attacks against other networks
scanning and compromising new systems
Installing sniffers
Installing keyloggers
Identify theft  


The remote web site appears to link to malicious JavaScript files hosted on a third party web site.  This means that the remote web site has been compromised, and it might infect its visitors as well.  This indicates that the remote web site is vulnerable to SQL injection attacks. 

The remote host is running a MySQL database.  In addition, a PHP script is installed that allows MySQL connections to be tunneled over HTTP.  This sort of connection is typically utilized when the database administrator does not have access to connect to the database from remote locations.  The tunnel does not use any sort of encryption and exposes credentials to passive sniffing.  In addition, as the PHP script connects to the database from the localhost, database authentication does not look for the originating IP address within the GRANT tables but instead uses the server IP as the originating source.  Not only does the script allow database admins to bypass firewall restrictions and log in insecurely, it also exposes the database to brute-force attacks from anonymous users.  

A Microsoft Windows shell is running on port 8888. This may indicate an infection by the Zotob worm, although other worms may also create a shell on this host.

The remote host has been compromised. 

The remote host appears to be running a machine that has been compromised and is being controlled by a botnet.  A botnet is a network of compromised computers that are remotely controlled by a malicious bot administrator.  Botnets are commonly used for
sending spam
running Denial of Service (DoS) attacks against other networks
scanning and compromising new systems
Installing sniffers
Installing keyloggers
Identify theft 

The remote host is running Immunity's Hydrogen server.  Hydrogen is a Backdoor/Trojan application that is often used by penetration-testing teams to backdoor a system that has been compromised. 

The remote client just started a Tor tunnel for routing network traffic over the Tor Tunnel network. The Tor tunnel allows users to run applications such as peer-to-peer clients, instant messaging and web browsers over a single encrypted tunnel.  Tor also tunnels and encrypts the DNS requests associated with such applications. By sending traffic over the Tor network, users can bypass corporate policies, firewalls, and guidelines.

The remote host is running GnoCatan, a game server for the GNOME environment. There is a buffer overflow in this service that may allow a remote attacker to gain a shell on this host. 

The remote host is running a Wingate Telnet Proxy server. If not configured securely, a Wingate Telnet Proxy server may be used by hackers to conceal their true origins by bouncing conections through these proxies.

A SETI@HOME client appears to be running on this port. This program may be used by malicious users to get your system information (processor type and the operating system). SETI@HOME client versions prior to 3.08 are vulnerable to a buffer overflow attack. 

The SyGate engine remote controller seems to be running on this port. It may be used by malicious users which are on the same subnet as yours to reconfigure this SyGate engine.

This host seems to be running SubSeven on this port. SubSeven is trojan which allows an intruder to take the control of the remote computer. An attacker may use it to steal your passwords, modify your data, and prevent your system from working properly. 

Phase Zero is installed. This backdoor allows anyone to partially take the control of the remote system. An attacker may use it to steal your password or prevent your system from working properly. 

The remote host is running EvilFTP. EvilFTP is a backdoor that sets up an FTP server on your machine. 

GirlFriend is installed. This backdoor allows anyone to partially take the control of the remote system. An attacker may use it to steal your password or prevent your system from working properly. 

Portal of Doom is installed. This backdoor allows anyone to partially take the control of the remote system. An attacker may use it to steal your password or prevent your system from working properly. 

GateCrasher is installed. This backdoor allows anyone to partially take the control of the remote system. An attacker may use it to steal your password or prevent your system from working properly. 

NetSphere is installed. This backdoor allows anyone to partially take control of the remote system. An attacker may use this vulnerability to steal your password or prevent your system from working properly. 

DeepThroat is installed on the remote host. This backdoor allows anyone to partially take the control of the remote system. An attacker may use it to steal your password or prevent your computer from working properly. 

The daemon 'clarkconnectd' seems to be running on this port. This daemon can provide sensitive information to attackers, such as the list of running processes, the content of /var/log/messages, the snort log file and more. An attacker may use it to gain more knowledge about this host.

The remote host is running a RemotelyAnywhere web server on this port. Make sure this software has been installed legitimately, as it is a tool of choice to many attackers, according to NAVCIRT.

The remote host is running a RemotelyAnywhere SSH server on this port. Make sure this software has been installed legitimately, as it is a tool of choice to many attackers, according to NAVCIRT.

The remote host has the backdoor '4553' installed. This implies that this host has probably been compromised. 

The backdoor 'BackDoor.Zincite.A' is installed on the remote host. It has probably been installed by the 'MyDoom.M' virus.  This backdoor may allow an attacker to gain unauthorized access on the remote host. 

The remote host is infected with MyDoom.M.  One of the features of MyDoom.M is to install a backdoor on port 1034.  An attacker, connecting to this backdoor would be given full access to the system. 

The remote host is using the Cydoor Topicks program. You should ensure that the user intended to install Cydoor (it is sometimes silently installed) and that the use of Cydoor matches your corporate mandates and security policies. 

The remote host is using the HOTBAR program. You should ensure that the user intended to install HOTBAR as it is sometimes silently installed. 

The remote host is using the EZULA program. You should ensure that the user intended to install EZULA (it is sometimes silently installed) and that the use of EZULA matches your corporate mandates and security policies.

The remote host is using the HOTBAR program. You should ensure that the user intended to install HOTBAR (it is sometimes silently installed) and that the use of HOTBAR matches your corporate mandates and security policies. 

The remote host is using the BARGAINBUDDY program. You should ensure that the user intended to install BARGAINBUDDY (it is sometimes silently installed) and that the use of BARGAINBUDDY matches your corporate mandates and security policies. 

The remote host is using the ALEXA program. This software is bundled by default with Internet Explorer 6.  This software transmits the complete URL of the search results to both 'msn.com' and 'alexa.com', thus potentially violating the privacy of the remote user.  You should ensure that the user intended to install ALEXA and that the use of ALEXA matches your corporate mandates and security policies.

The remote host is using the GATOR program.  You should ensure that the user intended to install GATOR (it is sometimes silently installed) and that the use of GATOR matches your corporate mandates and security policies. 

The remote web server is infected with JS.Scob.Trojan or Download.Ject Trojan.  This Trojan installs malicious code on all web pages and infects clients as they browse the server.  Specifically, the Trojan's dropper sets it as the document footer for all pages served. 

The remote host is infected with the Sasser Worm.  This worm utilizes a backdoor command server and FTP server on ports 5554 and 9996, respectively.   

The remote host has the Agobot.FO backdoor installed.  This backdoor is known to scan local networks for common Microsoft vulnerabilities, scan local networks for exploitable DameWare systems, brute force local Microsoft machine User accounts, connect to an IRC channel and setup a BOT for remote command execution.

The remote system appears to have iroffer. This program allows the machine to be used as an IRC fileserver. Iroffer and such bots are most common in warez and illegal file transfer agents.

The remote machine is infected with the MyDOOM/NoVarg virus/backdoor.

ID	Name	Severity
4487	Malicious Website - Embedded Javascript Detection	high
4481	Trojan Horse Client Detection	critical
4480	Trojan Horse Client Detection	critical
4479	Trojan Horse Client Detection	critical
4478	Trojan Horse Client Detection	critical
4477	Trojan Horse Client Detection	critical
4476	Trojan Horse Client Detection	critical
4471	Malware Payload Code Detection	critical
4470	Malicious Website - Embedded Iframe Detection	high
4441	Generic Botnet Server Detection (PING)	high
4401	Generic Botnet Server Detection (HTTP Client)	critical
4400	Generic Botnet Client Detection	high
4334	Malicious Website - JavaScript Files Linked on Web Site	critical
3804	SQLYog MySQL HTTP Tunnel Detection	medium
3164	Zotob Worm Infection (Microsoft)	critical
3117	Generic Botnet Client Detection (deprecated)	critical
2815	Hydrogen Server Detection	high
2542	Tor Tunnel Detection	medium
1921	GnoCatan Remote Overflow (deprecated)	critical
1920	WinGate Telnet Proxy Server Detection	medium
1919	SETI@HOME Client Detection	high
1918	Trojan/Backdoor - SyGate Detection	high
1917	Trojan/Backdoor - SubSeven Detection	high
1916	Trojan/Backdoor - Phase Zero Detection	high
1915	Trojan/Backdoor - EvilFTP Detection	high
1914	Trojan/Backdoor - GirlFriend Detection	high
1913	Trojan/Backdoor - Portal of Doom Detection (deprecated)	high
1912	Trojan/Backdoor - GateCrasher Detection	high
1911	Trojan/Backdoor - NetSphere Detection	high
1910	Trojan/Backdoor - DeepThroat Detection	critical
1909	ClarkConnect Linux clarkconnectd Information Disclosure	medium
1885	RemotelyAnywhere WWW Detection	info
1884	RemotelyAnywhere SSH Detection	info
1883	Trojan/Backdoor - 4553 Detection	high
1241	Trojan/Backdoor - BackDoor.Zincite.A Detection	critical
1240	Trojan/Backdoor - MyDoom.M Detection	critical
1236	Cydoor Topicks Software Detection	info
1235	Policy - HOTBAR Software Detection	info
1234	Policy - EZULA Software Detection	info
1233	Policy - HOTBAR Software Detection	info
1232	Policy - BARGAINBUDDY Software Detection	medium
1231	Policy - ALEXA Software Detection	info
1230	Policy - GATOR Software Detection	medium
1229	Trojan/Backdoor - JS.Scob.Trojan/Download.Ject Detection	critical
1215	Trojan/Backdoor Detection - Sasser Worm	critical
1207	Trojan/Backdoor - Agobot.FO Detection	critical
1185	Policy - iroffer Software Detection	info
1184	Policy - iroffer Software Detection	info
1183	Policy - iroffer Software Detection	info
1143	Trojan/Backdoor - MyDOOM/NoVarg Detection	critical

Detections

Analytics

Backdoors Family for Nessus Network Monitor

high

critical

critical

critical

critical

critical

critical

critical

high

high

critical

high

critical

medium

critical

critical

high

medium

critical

medium

high

high

high

high

high

high

high

high

high

critical

medium

info

info

high

critical

critical

info

info

info

info

medium

info

medium

critical

critical

critical

info

info

info

critical