Re: schoolbus trojan not listed as threat
Michel Arboi <[email protected]>
| Newsgroups | gmane.comp.security.nessus.general |
|---|---|
| Organization | Nessus.org |
| Message-ID | <20080430210836.3fc36063@casserole> |
On Wed, 30 Apr 2008 13:39:56 -0500 "Sergio Castro" <[email protected]> wrote: > I just ran a scan on a client's site and Nessus found this: "port > schoolbus (54321/tcp)". > AFAIK, this is a trojan Not necessarily. This port is (was?) used by a Trojan horse, this does not mean that it is currently used by this malware on your system. > yet the Nessus report does not classify it as a threat Well, trojan_horses.nasl would do that, *if* you set the paranoid mode, in which you'll have many false positive. > Is this a false positive? Errr... No. If you really have the Trojan horse, that's just the contrary: a false negative. Honestly, I think that you just found an open port, nothing more. It is hard to know without any additional information. -- http://www.bigfoot.com/~arboi http://ma75.blogspot.com/ PGP key ID : 0x0BBABA91 - 0x1320924F0BBABA91 Fingerprint: 1048 B09B EEAF 20AA F645 2E1A 1320 924F 0BBA BA91 _______________________________________________ Nessus mailing list [email protected] http://mail.nessus.org/mailman/listinfo/nessus