We have Tomcat 6 in the production server with Symantec Endpoint Protection on windows server 2008 server datacenter. Symantec showing following lines in logs

[SID: 27068] System Infected: Trojan.Naid Activity 2 attack blocked. Traffic has been blocked for this application: \DEVICE\HARDDISKVOLUME4\TOMCAT 6.0\BIN\TOMCAT6.EXE

It is clearly showing system Infected. What is Trojan.Naid exactly? What could be exactly infected in our system? Whether Windows and Tomcat combination is dangerous in production servers?


1 Answer 1


From here:

Trojan.Naid is a Trojan horse that opens a back door on the compromised computer.

When the Trojan is executed, it creates the following files:

%UserProfile%\AppMgmt.dll %Windir%\Temp\uid.ax

The Trojan creates the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet\Services\AppMgmt\"Start" = "2" HKEY_LOCAL_MACHINE\SYSTEM\ControlSet\Services\AppMgmt\Parameters\"ServiceDll" = "%UserProfile%\AppMgmt.dll" HKEY_LOCAL_MACHINE\SYSTEM\ControlSet\Services\AppMgmt\"Type" = "272" HKEY_LOCAL_MACHINE\SYSTEM\ControlSet\Services\AppMgmt\"FailureActions" = "[BINARY DATA]"

The Trojan may create one of the following services so that it runs every time Windows starts:

AppMgmt BITS

The Trojan collects the following system information from the compromised computer:

domain name unique identifier (UID)

The Trojan utilises its own custom communications protocol to connect to the following IP address over port 443:

The Trojan then opens a back door on the compromised computer.

So you should inspect at least mentioned paths, keys and services.

But trojan could be modified, so I'd also recommend to inspect network connections using netstat or Process Monitor and other tools from Sysinternals Suite.

Not the answer you're looking for? Browse other questions tagged .