Incident Handling of Back Orifice Trojan

This technical report details the incident handling of a Back Orifice Trojan infection at a U.S. university in February 2001. The report outlines the challenges faced by three individuals who, lacking prior incident handling training or a defined procedure, worked over eight days to identify and eradicate the Trojan. The infection resulted in several university hosts sending thousands of SMTP messages to an Australian mail host, contributing to a denial of service condition. The report explains the complexities involved, including the need for cooperation with an external system administrator and the unpredictable schedules of college students, which delayed the response time. Additionally, the report provides a description of the Back Orifice Trojan, its variants, methods of infection, and recommendations for detection, protection, and removal. The document serves as a practical guide for understanding the implications of such malware incidents and the necessary steps for effective incident management.