How Back Orifice, NetBus and Sub7 turned the home PC into something a stranger could steer, and how defenders moved from matching files to watching behavior.
A remote-access tool lets one computer control another over a network: see its screen, move files, run programs. System administrators have used such software for decades. A remote-access trojan (RAT) is the same idea delivered without the owner's knowledge or consent, usually disguised as something else, such as a game, a screensaver or a picture. The late-1990s tools on this page shared a simple shape. A small "server" program ran hidden on the target machine and waited for instructions; a "client" with a friendly graphical interface ran on the operator's machine. Because the client was point-and-click, using one required no programming skill, which is a large part of why they spread. They arrived when consumer Windows 95 and 98 had no built-in firewall, no user accounts in any meaningful security sense, and a growing population on always-reachable cable and DSL connections and dial-up chat services.
Sources and evidence limits
depth
General references; this summary describes the common architecture, not any one program's code
NetBus was written in 1998 by Carl-Fredrik Neikter in Sweden. It became notorious for tricks that announced its presence, such as opening the CD tray, swapping mouse buttons or showing messages, which gave it a reputation as a prank program. Its author described it as remote administration software, and a later version, NetBus Pro, was sold as such. Antivirus vendors classified it as a trojan regardless, because the server could be installed silently. NetBus also illustrates a lasting legal problem: Swedish reporting described a 1999 case in which material found on a university computer was later attributed to someone using NetBus, and the accused was cleared years afterward. Cases like this made "a trojan did it" a recognized defense that forensic examiners still have to rule in or out.
Sources and evidence limits
depth
Secondary references reviewed; the Swedish court case is reported second-hand and the individual is deliberately not named here
Authorship and dates as commonly reported; not independently verified
Back Orifice (1998) and BO2K (1999): a protest with a payload
The hacker group Cult of the Dead Cow (cDc) released Back Orifice at DEF CON 6 in August 1998. Its author was known as Sir Dystic, and its name mocked Microsoft BackOffice. cDc presented it as a demonstration: if a free program could quietly take over Windows 95 and 98, those systems were not fit for the trust people placed in them. Microsoft responded that users were safe if they didn't run untrusted programs, which missed the point cDc was making about a system with no barrier once they did. Back Orifice 2000 (BO2K), released at DEF CON 7 in 1999, added Windows NT support and a plugin design, and was published as open source. That move sharpened the dual-use argument: the same code could serve as an administration tool or a trojan, depending only on consent. Antivirus vendors added detections quickly, and the episode helped push the press, and eventually Microsoft, to take consumer Windows security seriously.
Sources and evidence limits
depth
Secondary references and published histories; cDc's original release materials not re-reviewed for this edition
Joseph Menn, Cult of the Dead Cow (PublicAffairs, 2019), a book-length history of the group
claim status
Release dates and authorship as widely reported; the group's motives are its own stated account
Sub7 (1999): the RAT as a consumer product
Sub7, also written SubSeven, appeared in 1999 and is credited to an author using the name mobman. It became the best-known RAT of its era because it bundled almost everything into one polished interface: file and screen access, keystroke capture, chat pranks and a tool for configuring the hidden server before sending it out. Infected machines could announce themselves to their operator over the chat networks of the day, such as IRC and ICQ, which tied Sub7 closely to the chat-room culture that also surrounded AOL add-on programs (see historical tools). Its wide spread made it a training case for defenders: Sub7 traffic and files became standard examples in antivirus signatures, intrusion-detection rules and the port lists that early personal firewalls warned about. Later versions were reported to contain a hidden master password, a reminder that people who ran these tools were often exposed to their authors too.
Sources and evidence limits
depth
Secondary references; no Sub7 binaries or source code acquired or examined
Feature descriptions are as commonly reported; the master-password claim is reported, not verified here
Why they matter in the history of malware
Earlier viruses mostly spread and damaged. These tools changed the goal to control: a person at the other end, watching and acting in real time. Several lasting patterns trace back to them. First, the dual-use debate, since the same software can be administration or intrusion, which is why antivirus vendors invented categories such as "hacktool", "riskware" and "potentially unwanted". Second, social engineering as the delivery method, since none of them needed a software vulnerability when people could be persuaded to open a file. Third, the commodity model, since free point-and-click tools put intrusion within reach of people with no technical background. The line runs forward to later RATs such as Poison Ivy, DarkComet and Gh0st RAT, which researchers documented in espionage and in the surveillance of activists, including the 2009 GhostNet investigation. Today's attackers often skip custom RATs entirely and misuse legitimate remote-support software, the original dual-use problem in its purest form.
Sources and evidence limits
depth
Original synthesis from the references listed; later-RAT attributions follow the cited reports
sources
Wikipedia: GhostNet (summarizing the Information Warfare Monitor's 2009 report)
Interpretive history; the three patterns are this archive's reading, not a quotation
Part two: countermeasures
Signatures: the first answer, and its limits
Classic antivirus works like a list of wanted posters. Vendors collect a sample, extract a fingerprint (a hash of the file, or a distinctive sequence of bytes inside it) and ship that fingerprint to every customer. Against Back Orifice and Sub7 this worked well, because millions of copies were identical. The weakness is that a signature only matches what has already been seen. Authors answered with "packers" and "crypters" that compress or encrypt the program so each copy looks different on disk, and with polymorphic code that rewrites itself. Signatures remain useful as a cheap first filter, and open rule languages such as YARA let defenders share them, but on their own they lose to anything new or deliberately disguised.
Sources
sources
YARA (open-source pattern-matching rules for malware research)
Firewalls and network watching
The 1990s RATs listened for connections on fixed, well-known ports, so blocking unsolicited inbound connections stopped many of them outright. Personal firewalls such as ZoneAlarm and BlackICE became popular around 1999 and 2000 partly for this reason, and Windows itself got a firewall that was turned on by default in XP Service Pack 2 in 2004. Network intrusion detection systems, starting with tools like Snort (1998), matched traffic against rules for known tools. Attackers responded by reversing the connection, so the infected machine calls out to the operator instead, which inbound firewalls don't block. Defenders followed with outbound (egress) filtering, DNS monitoring and analysis of "beaconing", the regular check-ins a hidden program makes. Modern network monitors such as Zeek and Suricata look at connection patterns and encrypted-traffic fingerprints rather than just port numbers.
When files stopped looking the same, antivirus started judging what they looked like they would do. Static heuristics score a file on suspicious traits: code that hides itself, imports for capturing keystrokes, instructions to install itself at startup. Emulation runs the first part of a program inside a simulated computer within the scanner, so a packed file unpacks itself and reveals what it really is. Sandboxing takes this further: an unknown file is opened in a disposable virtual machine, often in the vendor's cloud, and its behavior is recorded before it ever reaches the real machine. Malware authors answer by detecting sandboxes and waiting them out, so defenders keep making sandboxes look and behave more like real users' machines.
Next-generation antivirus: behavior and machine learning
"Next-generation antivirus" (NGAV) is the marketing name for products that lean on behavior and statistics instead of signature lists. Two ideas sit at the core. Behavioral detection watches what programs do while they run and blocks sequences that real software rarely performs together, such as a document reader launching a command shell, a process writing code into another process's memory, or a program encrypting hundreds of files a minute. Machine-learning classifiers are trained on millions of known good and bad files and give a new file a probability of being malicious from its structure alone, so they can catch a never-before-seen sample. Both trade certainty for coverage: they catch new threats but produce false positives, and models can be fooled by samples crafted to resemble legitimate software. Good products combine them with signatures and reputation (how many machines have seen this file, and who signed it).
Memory analysis and script scanning
Many modern intrusions never write a recognizable program to disk. They run inside the memory of a legitimate process, or as a script handed directly to an interpreter such as PowerShell. Defenders responded in two ways. Memory scanning inspects running processes for code that shouldn't be there, such as executable memory with no file behind it. Forensic frameworks such as the open-source Volatility do the same after the fact, from a captured memory image. And Windows 10 introduced the Antimalware Scan Interface (AMSI) in 2015, which lets security software see a script's actual content after it has been decoded, just before it runs, rather than the obfuscated version on disk.
Endpoint detection and response (EDR), a term Gartner analyst Anton Chuvakin popularized in 2013, accepts that prevention will sometimes fail and focuses on seeing and stopping an intrusion quickly. An EDR agent records telemetry from every machine: which processes started and who started them, network connections, file and registry changes, sign-ins. That history goes to a central system where rules and analysts look for the patterns of an intruder rather than a single bad file, often mapped to the MITRE ATT&CK catalog of attacker techniques. When something is found, responders can isolate the machine from the network, kill processes and trace exactly what happened. Extended detection and response (XDR) joins endpoint data with network, email, identity and cloud logs. Open tools such as osquery, Sysmon, Wazuh and Velociraptor let an organization build much of this on its own infrastructure. The cost is volume and privacy: endpoint telemetry is detailed, so who can read it, and how long it is kept, needs as much care as the threats it is meant to catch.
None of the tools above replaces the measures that would have stopped most 1990s RATs. Keep systems and software updated. Use accounts without administrator rights for daily work, so a program a person is tricked into running can do less. Allow only approved software to run where that is practical (application allowlisting, such as Windows App Control or AppLocker). Be wary of unexpected attachments and downloads, the delivery route for Sub7 and its peers. Use multi-factor authentication, so stolen passwords from a keystroke logger are not enough. And keep an inventory of the legitimate remote-access software in use, since attackers now often borrow those tools instead of bringing their own.
Page provenance
checked date
2026-10-16
rights
Original synthesis and source links only; no binaries, source code or third-party text hosted
scope
Historical and defensive explanation; deliberately excludes operational detail
Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.
Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.