Rule: -- Sid: 185 -- Summary: CDK is a Trojan Horse offering the attacker control of the victim host. This event is generated when an attacker connects to a victim server. -- Impact: Possible theft of data and control of the targeted machine leading to a compromise of all resources the machine is connected to. -- Detailed Information: This Trojan affects the following operating systems: Windows 95 Windows 98 Windows ME Windows NT Windows 2000 Windows XP -- Attack Scenarios: This Trojan may be delivered to the target in a number of ways. This event is indicative of an existing infection being activated. Initial compromise can be in the form of a Win32 installation program that may use the extension ".jpg" or ".bmp" when delivered via e-mail for example. -- Ease of Attack: This is Trojan activity, the target machine may already be compromised. Updated virus definition files are essential in detecting this Trojan. -- False Positives: None Known -- False Negatives: None Known -- Corrective Action: Restore a previously known good copy of the registry. A reboot of the infected machine is recommended. -- Contributors: Original Rule Writer Max Vision <vision@whitehats.com> Sourcefire Research Team Brian Caswell <bmc@sourcefire.com> Nigel Houghton <nigel.houghton@sourcefire.com> Original rule written by Paul Bobby <paul.bobby@lmco.com> Sourcefire Research Team Nigel Houghton <nigel.houghton@sourcefire.com> -- Additional References: Whitehats arachNIDS http://www.whitehats.com/info/IDS263 --
