12 Sept 2000 payerle@physics.umd.edu
Modified bin/backdoors.saint to check for qaz/notepad worm/trojan.  Also
modified html/tutorials/vulnerabilities/backdoor_found.html to mention
the qaz worm.

The included files were based on saint version 2.2.beta1p1.  Both the fully
modified files and a diff file are included to facilitate merges with other
saint versions.

Included in tar are:
bin/backdoors.saint.qaz: The new backdoors.saint script
bin/backdoors.saint.qazdiff: A diff of the original 2.2.beta1p1 backdoors.saint
	file and the one with qaz stuff.
html/tutorials/vulnerabilities/backdoor_found.html.qaz: The new tutorial
html/tutorials/vulnerabilities/backdoor_found.html.qazdiff: A diff of the
	original 2.2beta1p1 tutorial and the one with qaz stuff.

To install:
cd to the directory contain your saint installation and untar the qaz tarball
(should not overwrite anything).

If running an unmodified 2.2.beta1p1, you can probably just copy the 2 .qaz
file (but not the .qazdiff files) onto the respective files without the .qaz
extension (i.e. mv backdoors.saint.qaz backdoors.saint).  You may wish to
run a diff first and compare to the enclosed diffs just to make sure the 
update is on the same version.

If running another version of saint, you should use the diff and .qaz files to
patch your version of the files accordingly.  Should be rather straightforward.
For backdoors.saint, just add 7597 to list of TCP ports to scan, check for it,
and print out at end if found.  For backdoor_found.html, just add a paragraph
on qaz worm.
