(PVS) Signatures - Tenable Network Security

Description: Synopsis :\n\nThe remote host has a backdoor installed\n\nThe remote host is running
EvilFTP. EvilFTP is a backdoor that sets up an FTP server on your machine.
Solution: To remove this backdoor on Windows 95 and 98, delete the line "Run
CVE Not available
Trojan/Backdoor - Phase Zero Detection
PVS ID: 1916 FAMILY: Backdoors RISK: HIGH NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host has a backdoor installed.\n\nPhase Zero is installed. This
backdoor allows anyone to partially take the control of the remote system. An attacker may
use it to steal your password or prevent your system from working properly.
Solution: Look for the registry key MsgServ in
HKLM\Software\Microsoft\Windows\CurrentVersion\Run with value msgsvr32.exe.
Search for any suspicious files in the run key, and if found locate the file, open it and
search for the text string "phAse Zero". If found, then delete that file and delete the registry
value from the registry. Manually inspect and repair this system
CVE Not available
Trojan/Backdoor - SubSeven Detection
PVS ID: 1917 FAMILY: Backdoors RISK: HIGH NESSUS ID:10409
Description: Synopsis :\n\nThe remote host has a backdoor installed.\n\nThis host seems to be running
SubSeven on this port. SubSeven is trojan which allows an intruder to take the control of
the remote computer. An attacker may use it to steal your passwords, modify your data, and
prevent your system from working properly.
Solution: Use an up-to-date virus scanner to remove SubSeven or reinstall your system.
CVE Not available
Trojan/Backdoor - SyGate Detection
PVS ID: 1918 FAMILY: Backdoors RISK: HIGH NESSUS ID:10274
Description: Synopsis :\n\nThe remote host is running an inherently insecure protocol or
application.\n\nThe SyGate engine remote controller seems to be running on this port. It
may be used by malicious users which are on the same subnet as yours to reconfigure this
SyGate engine.
Solution: Uninstall the engine if not necessary.
CVE-2000-0113
SETI@HOME Client Detection
Passive Vulnerability Scanner (PVS) Signatures
Family Internet Services 488