Signature Detail

TROJAN: School Bus Backdoor

This signature detects commands sent to systems infected with the School Bus backdoor. School Bus, a backdoor Trojan loosely based on the NetBus Trojan, can delete Windows system files and send system information to the attacker controlling the Trojan.

Extended Description

School Bus is a Trojan horse with backdoor capability. It enables remote attackers to gain control over an affected machine. Some of the remote commands supported by School Bus are quite dangerous, such as File manager, Get system passwords, Get cached passwords, and Crash Windows.

References

• CVE: CVE-1999-0660
• URL: http://www.glocksoft.com/trojan_list/School_Bus.htm