;COMMENT: Deny backdoors and trojans
;DESCRIPTION: Detects packets of most frequent backdoors and trojans, such as BackOrifice and NetBus. Notice that Firewalls may mistake valid traffic as trojans, as the data streams and port numbers checked for may occur naturally in valid data.

BackOrifice-TCP	
		Comment = "BackOrifice backdoor access (tcp)",
		Protocol = TCP,
		Source-Port = "80",
		Rule-Action = Deny,
		Log-Control = Enabled,
		Log-Message = "BACKDOOR BackOrifice access",
		Log-Details = "This trojan is a network-administration utility for operating computers remotely. Using this backdoor, an attacker can compromise the security of a computer and steal documents, destroy data, etc. By following safe computing practices, for example, not downloading or running applications from unknown sources, users can protect themselves from the potential threat. A firewall on the compromised machine virtually makes it impossible for the attacker to communicate with the target machine. Since the detected packet suggests that the Backdoor/Trojan is already installed and running, it is advised to install anti-virus software.",
		Log-Severity = High,
		Hex-String = "server: BO/",
		Direction = Outgoing,
		Flags = "+ACK",

BackOrifice-UDP	
		Comment = "BackOrifice backdoor access (udp)",
		Protocol = UDP,
		Destination-Port = "31337",
		Rule-Action = Deny,
		Log-Control = Enabled,
		Log-Message = "BACKDOOR BackOrifice access",
		Log-Details = "This trojan is a network-administration utility for operating computers remotely. Using this backdoor, an attacker can compromise the security of a computer and steal documents, destroy data, etc. By following safe computing practices, for example, not downloading or running applications from unknown sources, users can protect themselves from the potential threat. A firewall on the compromised machine virtually makes it impossible for the attacker to communicate with the target machine. Since the detected packet suggests that the Backdoor/Trojan is already installed and running, it is advised to install anti-virus software.",
		Log-Severity = High,
		Hex-String = "\xce\x63\xd1\xd2\x16\xe7\x13\xcf\x39\xa5\xa5",
		Direction = Incoming,

NetBus	
		Comment = "NetBus backdoor access",
		Protocol = TCP,
		Source-Port = "12346 20034",
		Rule-Action = Deny,
		Log-Control = Enabled,
		Log-Message = "BACKDOOR NetBus active",
		Log-Details = "This trojan is a network-administration utility for operating computers remotely. Using this backdoor, an attacker can compromise the security of a computer and steal documents, destroy data, etc. By following safe computing practices, for example, not downloading or running applications from unknown sources, users can protect themselves from the potential threat. A firewall on the compromised machine virtually makes it impossible for the attacker to communicate with the target machine. Since the detected packet suggests that the Backdoor/Trojan is already installed and running, it is advised to install anti-virus software.",
		Log-Severity = High,
		Hex-String = "NetBus",
		Direction = Outgoing,
		Flags = "+ACK",

