Some routine scans on a subnet here yeilded several reports of Trin00 and Trin00 for windows on ports 27444 and 34555, respectively. Needless to say, I was a tad alarmed, and attempted to use nemesis to recreate the "png" packet used to check to see if the Trin00 master is present, but got no response that was sensed by ngrep.
I went to nessus's website and took a look at the source code for the attack (http://cvs.nessus.org/cgi-bin/cvsweb.cgi/~checkout~/nessus-plugins/scripts/trinoo.nasl), and it looks sound. Just to be sure, I reran nessus on the hosts that were listed as compromised, capturing the entire scanning session with ethereal. Not only did I not see the PONG responses from the hosts, but this time nessus reported that only a fraction of the previous positives were compromised. Forgive me if I'm overlooking something simple, but it seems that for some reason nessus is yielding false positives on Trin00 and Trin00 for windows tests. I have seen that others have reported some false positives for these.tests as well; if nothing else let me add my voice to the chorus. This is nessus 1.0.10 on debian sid. Bryan Klingner
