TROJAN: Subseven

This signature detects the runtime behavior of the spyware Subseven, a remote administration tool. After installation, this spyware obtains the IP address of a host machine, enabling attackers to perform multiple tasks remotely, such as deleting files, adding files, killing processes, scanning screen, recording activities, and extracting passwords.

Extended Description

Subseven is a well-known Trojan with a backdoor capabilities. It enables remote attackers to gain full control over an infected machine without the knowledge of the victim.

References

CVE: CVE-1999-0660

URL: http://nvd.nist.gov/nvd.cfm?cvename=CVE-1999-0660 http://www.megasecurity.org/trojans/s/subseven/Subseven_all.html

Short Name

TROJAN:SUBSEVEN:SUBSEVEN

Severity

Major

Recommended

False

Recommended Action

Drop

TROJAN: Subseven

Extended Description

References

Found a potential security threat?