# vim : set filetype=itval
#These queries are taken from some lists of vulnerable ports found
#on the internet.  They examine ports used by trojan horses, worms, and
#viruses that are probably not needed for normal system use.

#Acid Battery 1.0
QUERY SADDY IN NEW AND FOR BOTH 32418 AND ACCEPTED FORWARD;

#Acid Shivers
QUERY SADDY IN NEW AND FOR TCP 10520 AND ACCEPTED FORWARD;

#Agent 31
QUERY SADDY IN NEW AND FOR TCP 31 AND ACCEPTED FORWARD;

#Agent 40421
QUERY SADDY IN NEW AND FOR TCP 40421 AND ACCEPTED FORWARD;

#AimSpy
#Un-detected
QUERY SADDY IN NEW AND FOR TCP 777 AND ACCEPTED FORWARD;

#Ambush
QUERY SADDY IN NEW AND FOR TCP 10666 AND ACCEPTED FORWARD;

#AOL Trojan 1.1
QUERY SADDY IN NEW AND FOR TCP 30029 AND ACCEPTED FORWARD;

#Attack FTP
#BLA trojan
#Cain & Abel
#NokNok
#Satans Back Door - SBD
#ServU
#Shadow Phyre
#th3r1pp3rz
QUERY SADDY IN NEW AND FOR TCP 666 AND ACCEPTED FORWARD;

#Back Construction
SERVICE backcons UDP 21 BOTH 666 BOTH 5401 BOTH 5402 BOTH 5400;
QUERY SADDY IN NEW AND FOR backcons AND ACCEPTED FORWARD;

#Back Door 
SERVICE backdoor BOTH 5000 BOTH 5001 BOTH 7789 TCP 1999 BOTH 1243 BOTH 6776;
QUERY SADDY IN NEW AND FOR backdoor AND ACCEPTED FORWARD;

#Back Orifice
#Back Fire
#Baron Night
#SchoolBus 
#BO2
#DeepBO
SERVICE backorifice BOTH 31337 UDP 31338 UDP 54320 TCP 54321 UDP 1349;
QUERY SADDY IN NEW AND FOR backorifice AND ACCEPTED FORWARD;

#BO Facil
SERVICE bofacil TCP 5556 TCP 5557;
QUERY SADDY IN NEW AND FOR bofacil AND ACCEPTED FORWARD;

#BO JammerKillah 
QUERY SADDY IN NEW AND FOR TCP 121 AND ACCEPTED FORWARD;

#BOWhack
QUERY SADDY IN NEW AND (FOR TCP 31336 OR FOR TCP 31666) AND ACCEPTED FORWARD;

#BigGluck
QUERY SADDY IN NEW AND FOR TCP 34324 AND ACCEPTED FORWARD;

#Bla
QUERY SADDY IN NEW AND (FOR BOTH 20331 OR FOR BOTH 1024) AND ACCEPTED FORWARD;

#Blade Runner
#Digital Spy
SERVICE bladerunner TCP 5400 TCP 5401 TCP 5402;

#BoBo
QUERY SADDY IN NEW AND FOR TCP 4321 AND ACCEPTED FORWARD;

#BrainSpy
QUERY SADDY IN NEW AND FOR BOTH 10101 AND ACCEPTED FORWARD;

#Bubbel
QUERY SADDY IN NEW AND FOR BOTH 5000 AND ACCEPTED FORWARD;

#BUGS
QUERY SADDY IN NEW AND FOR TCP 2115 AND ACCEPTED FORWARD;

#Chupacabra
QUERY SADDY IN NEW AND FOR BOTH 20203 AND ACCEPTED FORWARD;

#Coma
QUERY SADDY IN NEW AND FOR TCP 10607 AND ACCEPTED FORWARD;

#Cyber Attacker
QUERY SADDY IN NEW AND FOR TCP 9876 AND ACCEPTED FORWARD;

#Danny
SERVICE danny BOTH 4567 BOTH 6912 BOTH 10607;
QUERY SADDY IN NEW AND FOR danny AND ACCEPTED FORWARD;

#Dark Shadow
QUERY SADDY IN NEW AND FOR TCP 911 AND ACCEPTED FORWARD;

#Deep Throat
SERVICE deepthroat BOTH 2140 BOTH 3150 TCP 60000 TCP 41 TCP 999 TCP 6670 TCP 6771;
QUERY SADDY IN NEW AND FOR deepthroat AND ACCEPTED FORWARD;

#Delta Source
SERVICE delta BOTH 26274 TCP 57252 UDP 47262 BOTH 6883;
QUERY SADDY IN NEW AND FOR delta AND ACCEPTED FORWARD;

#Der Spaeher 
QUERY SADDY IN NEW AND FOR BOTH 1000 AND ACCEPTED FORWARD;

#Devil 1.03
QUERY SADDY IN NEW AND FOR TCP 65000 AND ACCEPTED FORWARD;

#Digital RootBeer
QUERY SADDY IN NEW AND FOR BOTH 2600 AND ACCEPTED FORWARD;

#DM Setup Attack
QUERY SADDY IN NEW AND (FOR TCP 58 OR FOR BOTH 59) AND ACCEPTED FORWARD;

#Check for Sockets des Troie(Backdoor, Lame, IRC_trojan, W32/Ceval.gen),
#Trojan.Webus.B trojans

SERVICE sdt UDP 1 BOTH 5000 BOTH 5001 BOTH 30303 BOTH 50505 BOTH 60000 BOTH 65000;
QUERY SADDY IN NEW AND FOR sdt AND ACCEPTED FORWARD;

#Check for Death trojan
QUERY SADDY IN NEW AND FOR TCP 2 AND ACCEPTED FORWARD;

#Check for Obsolete Services
SERVICE obsolete TCP 7 TCP 9 BOTH 11 BOTH 13 BOTH 19;
QUERY SADDY IN NEW AND FOR obsolete AND ACCEPTED FORWARD;

#Check for FSP/FTP
QUERY SADDY IN NEW AND FOR UDP 21 AND ACCEPTED FORWARD;

#Check for Old PcAnywhere 
QUERY SADDY IN NEW AND FOR UDP 22 AND ACCEPTED FORWARD;

#Check for Deep Throat, Foreplay Trojans
QUERY SADDY IN NEW AND FOR BOTH 41 AND ACCEPTED FORWARD;

#Check for DRAT trojacn
SERVICE drat TCP 48 TCP 50;
QUERY SADDY IN NEW AND FOR drat AND ACCEPTED FORWARD;

#Check for BackGate Kit, Nimda, Pasana, Storm, Storm work, Theef, W32.Blaster.Worm, W32.Welchia.Worm.
QUERY SADDY IN NEW AND (FOR UDP 69 OR FOR TCP 4444 OR FOR TCP 135) AND ACCEPTED FORWARD;

#Check for ADM worm and Firehotcker
QUERY SADDY IN NEW AND FOR BOTH 79 AND ACCEPTED FORWARD;

#Check for W32.Beagle.AO@mm and W32.Beagle.AR@mm
SERVICE beagle UDP 80 BOTH 81;
QUERY SADDY IN NEW AND FOR beagle AND ACCEPTED FORWARD;

#Check for ADM worm, MscanWrom
QUERY SADDY IN NEW AND FOR UDP 111 AND ACCEPTED FORWARD;

#Check for ADM worm, Alicia, Cyn, DataSpy Network X, Dosh, Gibbon, Invisible Identd Deamon, Kazimas, Taskman
QUERY SADDY IN NEW AND FOR BOTH 113 AND ACCEPTED FORWARD;

#Check for Attack Bot, god Message, JammerKillah
QUERY SADDY IN NEW AND FOR TCP 121 AND ACCEPTED FORWARD;

#Check for Chode, god Message, Msinit, Netlog, Network, Qaz, W32.HLLW.Moega
#(on NETBIOS ports).
SERVICE netbios BOTH 137 BOTH 138 BOTH 139;
QUERY SADDY IN NEW AND FOR netbios AND ACCEPTED FORWARD;

#Check for W32.Deloader, IraqiWorm, W32.HLLW.Moega, W32.Sasser.Worm, W32.Korgo.AB, Backdoor.Rtkit.B, Windoes Null Session Exploit.
QUERY SADDY IN NEW AND FOR TCP 445 AND ACCEPTED FORWARD;

#Check for Hackers Paradise Trojan
QUERY SADDY IN NEW AND FOR TCP 456 AND ACCEPTED FORWARD;

#Check for 711 trojan, Ini-Killer, Net Administrator(NeTadmin), Phase Zero, Stealth Spy
QUERY SADDY IN NEW AND FOR TCP 555 AND ACCEPTED FORWARD;

#Check for HoaVelu trojan
QUERY SADDY IN NEW AND FOR TCP 654 AND ACCEPTED FORWARD;

#Check for DP trojan, SniperNET
QUERY SADDY IN NEW AND FOR TCP 669 AND ACCEPTED FORWARD;

#Check for NetDevil trojan
SERVICE netdevil TCP 901 TCP 902 TCP 903;
QUERY SADDY IN NEW AND FOR netdevil AND ACCEPTED FORWARD;

#Check for DeepThroat, F0replay, WinSatan trojans
QUERY SADDY IN NEW AND FOR TCP 999 AND ACCEPTED FORWARD;

#Check for Direct Connection, Le Guardien, Silencer, WebEx trojans
SERVICE dlsw TCP 1001;
QUERY SADDY IN NEW AND FOR dlsw AND ACCEPTED FORWARD;

#Check for Doly trojan
SERVICE doly TCP 1010 TCP 1011 TCP 1015;
QUERY SADDY IN NEW AND FOR doly AND ACCEPTED FORWARD;

#Check for Netspy2 trojan
QUERY SADDY IN NEW AND FOR TCP 1033 AND ACCEPTED FORWARD;

#Check for Backdoor.Systsec trojan
QUERY SADDY IN NEW AND FOR TCP 1034 AND ACCEPTED FORWARD;

#Check for Bla1.1 trojan
QUERY SADDY IN NEW AND FOR TCP 1042 AND ACCEPTED FORWARD;

#Check for Wingate, Bugbear.xx, SubSeven, WinHOle, Trojan.Webus.C, Mydoom.B
QUERY SADDY IN NEW AND FOR TCP 1080 AND ACCEPTED FORWARD;

#Check for Blood Fest Evolution, Hvl RAT, Remote Administration Tool - RAT
SERVICE bfehvl TCP 1095 TCP 1096 TCP 1097 TCP 1098 TCP 1099 TCP 2283;
QUERY SADDY IN NEW AND FOR bfehvl AND ACCEPTED FORWARD;

#Check for Backdoor.AIMvision, Backdoor.Ultor, Backdoor.Daodan trojans
QUERY SADDY IN NEW AND FOR TCP 1111 AND ACCEPTED FORWARD;

#Check for Last 2000, Singularity(Backdoor.Singu) trojans
QUERY SADDY IN NEW AND (FOR TCP 1122 OR FOR TCP 7788) AND ACCEPTED FORWARD;

#Check for W32/Colevo@MM worm and Psyber Streaming Audio Server trojan
SERVICE colevo TCP 1168 TCP 1169 TCP 1170 TCP 2536 TCP 1509;
QUERY SADDY IN NEW AND FOR colevo AND ACCEPTED FORWARD;

#Check for Backdoor.Sazo, Force/Feardoor trojan
QUERY SADDY IN NEW AND FOR TCP 1218 AND ACCEPTED FORWARD;

#Check for Backdoor.Ultor trojan
QUERY SADDY IN NEW AND FOR TCP 1234 AND ACCEPTED FORWARD;

#Check for Voodoo trojan
QUERY SADDY IN NEW AND FOR TCP 1245 AND ACCEPTED FORWARD;

#Check for Maverick's Matrix trojan
QUERY SADDY IN NEW AND FOR TCP 1269 AND ACCEPTED FORWARD;

#Check for Gaobot worms
QUERY SADDY IN NEW AND (FOR BOTH 1433 OR FOR BOTH 1444) AND ACCEPTED FORWARD;

#Check for FTP99CMP trojan
QUERY SADDY IN NEW AND FOR TCP 1492 AND ACCEPTED FORWARD;

#Check for Backdoor.Miffice
QUERY SADDY IN NEW AND FOR TCP 1533 AND ACCEPTED FORWARD;

#Check for Shiva Burka, Backdoor.DirectConnection trojans
SERVICE sbdc TCP 1600 TCP 1601 TCP 1602;
QUERY SADDY IN NEW AND FOR sbdc AND ACCEPTED FORWARD;

#Check for SpySender
QUERY SADDY IN NEW AND (FOR TCP 1807 OR FOR TCP 3418) AND ACCEPTED FORWARD;

#Check for For Your Eyes Only, WM FTP Server trojans
QUERY SADDY IN NEW AND FOR TCP 1967 AND ACCEPTED FORWARD;

#Check for Backdoor.Bifrose trojan
QUERY SADDY IN NEW AND FOR TCP 1971 AND ACCEPTED FORWARD;

#Check for ZSPYII 0.99b
QUERY SADDY IN NEW AND (FOR TCP 1979 OR FOR TCP 1980) AND ACCEPTED FORWARD;

#Check for Bowl, Shockrave trojans
QUERY SADDY IN NEW AND FOR TCP 1981 AND ACCEPTED FORWARD;

#Check for RemoteAnywhere webserver, Der Spaher, Fear, Force, GOTHIC Intruder, Insane Network, Last 2000, Real 2000, Remote Explorer 2000, Senna Spy Trojan Generator, Singularity, and Backdoor.Fearic trojans.
QUERY SADDY IN NEW AND FOR TCP 2000 AND ACCEPTED FORWARD;

#Check for Der Spaher, Duddie, Glacier, Protoss, Senna Spy Trojan Generator, Singularity, Trojan Cow
QUERY SADDY IN NEW AND FOR TCP 2001 AND ACCEPTED FORWARD;

#Check for Duddie, Senna Spy Trojan Generator, Sensive
QUERY SADDY IN NEW AND FOR TCP 2002 AND ACCEPTED FORWARD;

#Check for Backdoor.Rockse
QUERY SADDY IN NEW AND (FOR TCP 2020 OR FOR TCP 2525) AND ACCEPTED FORWARD;

#Check for Ripper Pro trojan
QUERY SADDY IN NEW AND FOR TCP 2023 AND ACCEPTED FORWARD;

#Check for PWSteal.Lapinch.C trojan
QUERY SADDY IN NEW AND FOR TCP 2050 AND ACCEPTED FORWARD;

#Check for Backdoor.Expjan trojan
QUERY SADDY IN NEW AND FOR TCP 2090 AND ACCEPTED FORWARD;

#Check for Deep Throat, Foreplay, The Invasor trojans
QUERY SADDY IN NEW AND FOR TCP 2140 AND ACCEPTED FORWARD;

#Check for Backdoor.Delf trojan
QUERY SADDY IN NEW AND FOR TCP 2189 AND ACCEPTED FORWARD;

#Check for Dumaru.Y trojan
SERVICE dumaru TCP 2283 TCP 10000;
QUERY SADDY IN NEW AND FOR dumaru AND ACCEPTED FORWARD;

#Check for VBS.Shania trojan
QUERY SADDY IN NEW AND FOR TCP 2414 AND ACCEPTED FORWARD;

#Check for Backdoor.Delf trojan
SERVICE delf TCP 2444 TCP 27378 TCP 2189 TCP 23;
QUERY SADDY IN NEW AND FOR delf AND ACCEPTED FORWARD;

#Check for W32.Beagle.W@mm, W32.Beagle.X@mm
QUERY SADDY IN NEW AND (FOR TCP 2535 OR FOR TCP 2556) AND ACCEPTED FORWARD;

#Check for Beagle.C and Beagle.K
QUERY SADDY IN NEW AND FOR TCP 2745 AND ACCEPTED FORWARD;

#Check for SubSeven, SubSeven 2.1 Gold trojans
QUERY SADDY IN NEW AND (FOR TCP 2773 OR FOR TCP 2774 OR FOR TCP 7215) AND ACCEPTED FORWARD;

#Check for W32.Novarg.A@mm and W32/Mydoom@MM worms
SERVICE novarg TCP 3127 TCP 3128 TCP 3129 TCP 3130 TCP 3131 TCP 3132 TCP
3133 TCP 3134 TCP 3135 TCP 3136 TCP 3137 TCP 3138 TCP 3139 TCP 3140 TCP
3141 TCP 3142 TCP 3143 TCP 3144 TCP 3145 TCP 3146 TCP 3147 TCP 3148 TCP
3149 TCP 3150 TCP 3151 TCP 3152 TCP 3153 TCP 3154 TCP 3155 TCP 3156 TCP
3157 TCP 3158 TCP 3159 TCP 3160 TCP 3161 TCP 3162 TCP 3163 TCP 3164 TCP
3165 TCP 3166 TCP 3167 TCP 3168 TCP 3169 TCP 3170 TCP 3171 TCP 3172 TCP
3173 TCP 3174 TCP 3175 TCP 3176 TCP 3177 TCP 3178 TCP 3179 TCP 3180 TCP
3181 TCP 3182 TCP 3183 TCP 3184 TCP 3185 TCP 3186 TCP 3187 TCP 3188 TCP
3189 TCP 3190 TCP 3191 TCP 3192 TCP 3193 TCP 3194 TCP 3195 TCP 3196 TCP
3197 TCP 3198;
QUERY SADDY IN NEW AND FOR novarg AND ACCEPTED FORWARD;

#Check for W32.HLLW.Dax
QUERY SADDY IN NEW AND FOR TCP 3256 AND ACCEPTED FORWARD;

#Check for Q0 Backdoor trojan
QUERY SADDY IN NEW AND FOR TCP 3332 AND ACCEPTED FORWARD;

#Check for Backdoor.Optixprot trojan
QUERY SADDY IN NEW AND FOR TCP 3410 AND ACCEPTED FORWARD;

#Check for Backdoor.Fearic trojan
QUERY SADDY IN NEW AND (FOR TCP 3456 OR FOR TCP 8811) AND ACCEPTED FORWARD;

#Check for Backdoor.Amitis trojan
SERVICE amitis TCP 3457 TCP 7823 TCP 12345 TCP 13173 TCP 44280 TCP 44390 TCP 47387 TCP 64429;
QUERY SADDY IN NEW AND FOR amitis AND ACCEPTED FORWARD;

#Check for Eclipse 2000, Sanctuary Trojans
QUERY SADDY IN NEW AND FOR TCP 3459 AND ACCEPTED FORWARD;

#Check for Portal of Doom trojan
SERVICE pod TCP 3700 TCP 9872 TCP 9873 TCP 9874 TCP 9875 TCP 10067 TCP 10167;
QUERY SADDY IN NEW AND FOR pod AND ACCEPTED FORWARD;

#Check for Backdoor.Helios trojan
QUERY SADDY IN NEW AND FOR TCP 3737 AND ACCEPTED FORWARD;

#Check for Backdoor.Mirab trojan
SERVICE mirab TCP 4912 TCP 6430;
QUERY SADDY IN NEW AND FOR mirab AND ACCEPTED FORWARD;

#Check for Backdoor.OPtix.04.c trojan
QUERY SADDY IN NEW AND FOR TCP 5151 AND ACCEPTED FORWARD;

#Check for Backage, Netdemon trojan
QUERY SADDY IN NEW AND FOR TCP 5333 AND ACCEPTED FORWARD;

#Check for W32.Sasser.Worm trojan
QUERY SADDY IN NEW AND (FOR TCP 5554 OR FOR TCP 9996) AND ACCEPTED FORWARD AND ACCEPTED FORWARD;

#Check for Easyserv.11 Trojan
QUERY SADDY IN NEW AND FOR TCP 5588 AND ACCEPTED FORWARD;

#Check IRC ports expolited by trojans(Backdoor.IRC.Flood, Backdoor.Hacarmy.E, W32.Spybot.EAS, Backdoor.Sdbot.AC, Backdoor.Hacarmy.E)
SERVICE irc TCP 6665 TCP 6666 TCP 6667 TCP 6668 TCP 6669;
QUERY SADDY IN NEW AND FOR irc AND ACCEPTED FORWARD;

#Check for SubSeven/BackDoor-G, VP Killer, Backdoor.Kilo trojans
QUERY SADDY IN NEW AND (FOR TCP 6711 OR FOR TCP 6718) AND ACCEPTED FORWARD;
 
#Check for GateCrasher, IRC 3/IRC Hack, Net Controller, Priority trojans
QUERY SADDY IN NEW AND FOR TCP 6969 AND ACCEPTED FORWARD;

#Check for Exploit Translation Server, Kazimas, Remote Grab, SubSeven trojans
QUERY SADDY IN NEW AND FOR TCP 7000 AND ACCEPTED FORWARD;

#Check for NetMonitor trojan
SERVICE netmonitor TCP 7300 TCP 7301 TCP 7302 TCP 7303 TCP 7304 TCP 7305 TCP 7306 TCP 7307 TCP 7308;
QUERY SADDY IN NEW AND FOR netmonitor AND ACCEPTED FORWARD;

#Check for Backdoor.WinShell.50 trojan
QUERY SADDY IN NEW AND (FOR TCP 8719 OR FOR TCP 39581) AND ACCEPTED FORWARD;

#Check for Beagle.B worm
QUERY SADDY IN NEW AND FOR TCP 8866 AND ACCEPTED FORWARD;

#Check for W32.Axatak virus
QUERY SADDY IN NEW AND (FOR TCP 8888 OR FOR TCP 8889) AND ACCEPTED FORWARD;

#Check for Gholame trojan
QUERY SADDY IN NEW AND (FOR TCP 9696 OR FOR TCP 9697) AND ACCEPTED FORWARD;

#Check for Backdoor.Sokeven trojan
QUERY SADDY IN NEW AND FOR TCP 9867 AND ACCEPTED FORWARD;

#Check for Backdoor.Lolok, Cyber Attacker, Rux trojans
QUERY SADDY IN NEW AND FOR TCP 9876 AND ACCEPTED FORWARD;

#Check for Dabber.A and Dabber.B worms
QUERY SADDY IN NEW AND FOR TCP 9898 AND ACCEPTED FORWARD;

#Check for Backdoor.Zdemon.126
QUERY SADDY IN NEW AND (FOR TCP 10001 OR FOR TCP 10002) AND ACCEPTED FORWARD;

#Check for Mydoom.B worm
QUERY SADDY IN NEW AND FOR TCP 10080 AND ACCEPTED FORWARD;

#Check for Backdoor.Lowtaper trojan
QUERY SADDY IN NEW AND (FOR TCP 10104 OR FOR TCP 24681) AND ACCEPTED FORWARD;

#Check for W23.HLLW.Lovgate
QUERY SADDY IN NEW AND FOR TCP 10168 AND ACCEPTED FORWARD;

#Check for Trojan.Webus.C trojan
QUERY SADDY IN NEW AND FOR TCP 10888 AND ACCEPTED FORWARD;

#Check for Darface, Latinus, Pestdoor, Vagr Nocker trojans
QUERY SADDY IN NEW AND FOR TCP 11831 AND ACCEPTED FORWARD;

#Check for Satan Crew trojan
QUERY SADDY IN NEW AND FOR TCP 12000 AND ACCEPTED FORWARD;

#Check for NetBus, Ashley, Fat Bitch, GabanBus, icmp_client.c, icmp_pipe.c, Mypic, Pie Bill Gates, Whack Job, X-bill trojans
QUERY SADDY IN NEW AND (FOR TCP 12345 OR FOR TCP 12346) AND ACCEPTED FORWARD;

#Check for GCI BioNet trojan
QUERY SADDY IN NEW AND (FOR TCP 12348 OR FOR TCP 12349) AND ACCEPTED FORWARD;

#Check for Backdoor.Cyn trojan
QUERY SADDY IN NEW AND FOR TCP 15432 AND ACCEPTED FORWARD;

#Check for Backdoor.Lastdoor trojan
QUERY SADDY IN NEW AND FOR TCP 16322 AND ACCEPTED FORWARD;

#Check for Milkit(Spybot 3), Kuang2 the virus trojans
QUERY SADDY IN NEW AND FOR TCP 17300 AND ACCEPTED FORWARD;

#Check for Netbus, NetRex, Whack Job trojans
QUERY SADDY IN NEW AND FOR TCP 20034 AND ACCEPTED FORWARD;

#Check for Trojan.Mitglieder.E trojan
QUERY SADDY IN NEW AND FOR TCP 20742 AND ACCEPTED FORWARD;

#Check for Exploiter, Kid Terror, Schwindler, Winsp00fer trojans
QUERY SADDY IN NEW AND FOR TCP 21554 AND ACCEPTED FORWARD;

#Check for Donald Dick, Prosiak, Ruler, RUX The TIc.K trojans
QUERY SADDY IN NEW AND FOR TCP 22222 AND ACCEPTED FORWARD;

#Check for Backdoor.Simali trojan
QUERY SADDY IN NEW AND FOR TCP 22311 AND ACCEPTED FORWARD;

#Check for Evil FTP, Ugly FTP, WhackJob trojans
QUERY SADDY IN NEW AND FOR TCP 23456 AND ACCEPTED FORWARD;

#Check for SubSeven, Ramen, Bad Blood, Seeker, Ttfloader trojans
QUERY SADDY IN NEW AND FOR BOTH 27374 AND ACCEPTED FORWARD;

#Check for Backdoor.Ducktoy, Backdoor.Latinus trojans
QUERY SADDY IN NEW AND (FOR TCP 29559 OR FOR TCP 11831) AND ACCEPTED FORWARD;

#Check for Backdoor.AntiLam trojan
QUERY SADDY IN NEW AND FOR TCP 29999 AND ACCEPTED FORWARD;

#Check for Backdoor.Grobodor trojan
QUERY SADDY IN NEW AND FOR TCP 31332 AND ACCEPTED FORWARD;

#Check for Windows Hack'a'Tack trojan
QUERY SADDY IN NEW AND (FOR UDP 31789 OR FOR UDP 31790) AND ACCEPTED FORWARD;

#Check for Peanut Brittle, Project nEXT trojans
QUERY SADDY IN NEW AND FOR TCP 32100 AND ACCEPTED FORWARD;

#Check for Backdoor.Acropolis trojan
QUERY SADDY IN NEW AND FOR TCP 32791 AND ACCEPTED FORWARD;

#Check for Blakharaz, Prosiak trojans
QUERY SADDY IN NEW AND FOR TCP 33333 AND ACCEPTED FORWARD;

#Check for W32.Bugbear@mm worm
QUERY SADDY IN NEW AND FOR TCP 36794 AND ACCEPTED FORWARD;

#Check for Backdoor.Winshell.50.b trojan
QUERY SADDY IN NEW AND FOR TCP 39581 AND ACCEPTED FORWARD;

#Check for Trojan.Mitglieder.C trojan
QUERY SADDY IN NEW AND FOR TCP 39999 AND ACCEPTED FORWARD;

#Check for Master's Paradise trojan
SERVICE master TCP 40422 TCP 40423 TCP 40424 TCP 40425 TCP 40426;
QUERY SADDY IN NEW AND FOR master AND ACCEPTED FORWARD;

#Check for Backdoor.Acropolis trojan
QUERY SADDY IN NEW AND FOR TCP 45673 AND ACCEPTED FORWARD;

#Check for Backdoor.AntiLam trojan
QUERY SADDY IN NEW AND FOR TCP 47387 AND ACCEPTED FORWARD;

#Check for Backdoor.Cyn
QUERY SADDY IN NEW AND FOR TCP 51234 AND ACCEPTED FORWARD;

#Check for Backdoor.Roxe
QUERY SADDY IN NEW AND FOR TCP 55000 AND ACCEPTED FORWARD;

#Check for File Manager, WM Trojan Generator trojans
QUERY SADDY IN NEW AND FOR TCP 55165 AND ACCEPTED FORWARD;

#Check for Backdoor.Osirdoor trojan
QUERY SADDY IN NEW AND FOR TCP 56565 AND ACCEPTED FORWARD;

#Check for Backdoor.IRC.Cirebot trojan
SERVICE cirebot TCP 445 TCP 69 TCP 57005;
QUERY SADDY IN NEW AND FOR cirebot AND ACCEPTED FORWARD;

#Check for NetRaider trojan
QUERY SADDY IN NEW AND FOR TCP 57341 AND ACCEPTED FORWARD;

#Check for Backdoor.Tron trojan
QUERY SADDY IN NEW AND (FOR TCP 58008 OR FOR TCP 58009) AND ACCEPTED FORWARD;

#Check for Backdoor.Prorat trojan
QUERY SADDY IN NEW AND FOR TCP 58343 AND ACCEPTED FORWARD;

#Check for Backdoor.Redkod trojan
QUERY SADDY IN NEW AND FOR TCP 58666 AND ACCEPTED FORWARD;

#Check for Backdoor.Ducktoy trojan
QUERY SADDY IN NEW AND FOR TCP 59211 AND ACCEPTED FORWARD;

#Check for Backdoor.Mite trojan
QUERY SADDY IN NEW AND FOR TCP 61000 AND ACCEPTED FORWARD;

#Check for Telecommando trojan
QUERY SADDY IN NEW AND FOR TCP 61466 AND ACCEPTED FORWARD;

#Check for W32.Gaobot.ADX worm
SERVICE gaobot TCP 63000 TCP 63001 TCP 30001;
QUERY SADDY IN NEW AND FOR gaobot AND ACCEPTED FORWARD;

#Check for PhatBot trojan
QUERY SADDY IN NEW AND FOR TCP 65506 AND ACCEPTED FORWARD;

#Check for ShitHeep trojan
QUERY SADDY IN NEW AND FOR TCP 65535 AND ACCEPTED FORWARD;
