[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Full-Disclosure] unknown backdoor: 220 StnyFtpd 0wns j0
- To: Ryan Sumida <rsumida@xxxxxxxxx>
- Subject: Re: [Full-Disclosure] unknown backdoor: 220 StnyFtpd 0wns j0
- From: joe smith <joe@xxxxxxxxxxxxxxxxxxx>
- Date: Thu, 23 Sep 2004 13:37:00 -0500
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_KIBUV.B&VSect=T
Ryan Sumida wrote:
I've been finding a few compromised Windows systems on our campus that
have a random port open with a banner of "220 StnyFtpd 0wns j0". All
the systems seem to be doing SYN scans on port 445 and LSASS buffer
overflow attempts. Anyone know what worm/bot is doing this? I don't
have access to these machines so I can only get a network view of what
the systems are doing.
Thanks,
Ryan
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html