Re: OT SubSeven Back door Trojan

["Graham Butler" <graham@xxxxxxx>]

It's likely to be just random scans -  Norton's picking them up and
blocking
them, so I wouldn't worry about it.

One thing to check (on a more general level) is whether Norton stealths
your
ports or actively responds with a "not open" message.  If the
former, no
response is generated at all, so the attacker doesn't even know a PC exists
on that IP.  If the latter, then your IP could get logged for them to try
any other type of attack they may have.

The holiday periods are always more active because of school/college/etc
breaks, ie more time for the muppets to get bored and resort to long,
unattended scans.

The frequency of this particular one appearing may also be down to a new
scanner or SubSeven controller suddenly appearing on the "market"
- it's one
of the older "easy-to-use" remote-control trojans, and variations
are always
appearing.  Most of the time though, the differences are in the front end,
the delivery method, add-on tools (proxy scanners, IP logging,
proxy-bouncing etc etc) as those bits are easier to customise and develop
than disguising the attack as something other than S7 to get around
security
products.

G
----- Original Message -----
From: "Stuart Whyte" <lists@xxxxxxx>
To: "UKHA" <ukha_d@xxxxxxx>
Sent: Wednesday, January 02, 2002 2:24 PM
Subject: [ukha_d] OT SubSeven Back door Trojan


> Gents,
>
> Ove the last few days, I have been getting a lot of Norton Internet
Security
> alerts saying a connection is trying to be made on port 27374
(SubSeven
Back
> door Trojan)the attacks are coming from different ISP ranges, so Im
not
> convinced its a PERSISTANT attacker, more random attacks.  It is,
however,
> the only alert that keeps apearing.  Does anyone know what it is, is
it
> likely to be a script kiddie, and should I just ignore it??
>
> Thanks in advance.
>
> Stuart
>
>
>
>
> For more information: http://www.automatedhome.co.uk
> Post message: ukha_d@xxxxxxx
> Subscribe:  ukha_d-subscribe@xxxxxxx
> Unsubscribe:  ukha_d-unsubscribe@xxxxxxx
> List owner:  ukha_d-owner@xxxxxxx
>
> Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/
>