Snake_Byte
June 4th, 2002, 07:04 PM
There are hundreds of trojans and different backdoors out on the internet but one ive found seems to me to be the most dangerous. It's called Ackcmd from http://ntsecurity.nu/toolbox/
what it does is when the user/hacker/cracker what ever you want to call them, opens up the client he types in commands to be executed on the target host. The client then encodes the commands into ackpackets and sends them to the target. because they are ack packets they have a better chance of penetrating a firewall then anything else. When the server recives the packets it executes the command and send the reply back via encoded ack packets. As you can see this backdoor is very dangerous and can give the attacker alot of power over your machine. But it gets worse unlike most backdoors they show up on antivirus sweeps but not ackcmd, ackcmd is completly stealth. To remove the server just search for ackcmdS.exe but remember script kiddies the only "hackers" that use widely distributed trojans love to use binders or mergers To remain stealthy which doesnt work if the target has antivirus because most all antivirus software has the ablity to scan executables for virii or trojans, But as I said before ackcmdS wont show up on most antivirus software. So an ackcmd server bound with an executable will prove a pretty powerful tool to a script kiddie, well even a pretty skilled hacker it would prove useful. I hope antivirus companies will fix this problem.
what it does is when the user/hacker/cracker what ever you want to call them, opens up the client he types in commands to be executed on the target host. The client then encodes the commands into ackpackets and sends them to the target. because they are ack packets they have a better chance of penetrating a firewall then anything else. When the server recives the packets it executes the command and send the reply back via encoded ack packets. As you can see this backdoor is very dangerous and can give the attacker alot of power over your machine. But it gets worse unlike most backdoors they show up on antivirus sweeps but not ackcmd, ackcmd is completly stealth. To remove the server just search for ackcmdS.exe but remember script kiddies the only "hackers" that use widely distributed trojans love to use binders or mergers To remain stealthy which doesnt work if the target has antivirus because most all antivirus software has the ablity to scan executables for virii or trojans, But as I said before ackcmdS wont show up on most antivirus software. So an ackcmd server bound with an executable will prove a pretty powerful tool to a script kiddie, well even a pretty skilled hacker it would prove useful. I hope antivirus companies will fix this problem.