compromised hosts. RID can remotely detect Stacheldraht, TFN, Trinoo and TFN2k if the attacker did not change the default ports.