spyware

[dmorone]

I'd like my Cisco IDS to alarm on traffic from any of these spyware products:

http://www.spy-software-online.com/index.html

Can Cisco IDS do this?

I consider them trojans and espionage aids. I've contacted Symantec. They won't consider them virus trojans. I'm finding it difficult to ascertain how these 'trojans' communicate back to the master. If I knew more port info, I could block at fw also.

[mcerha]

We will add put this to our list of potential signatures. If you have a specific example of a signature that you need, please let us know, and we'll try to look into it more expidiously.

[otoujagui]

How can you have a signature that can capture this sort of spyware? As I understand it this sort of application is strickly host based and does not traverse the network.

[d.twaddle]

Here are two lists that are very complete:

http://www.dark-e.com/archive/trojans/ports.shtml

http://www.onctek.com/trojanports.html