Re: [Full-Disclosure] unknown backdoor: 220 StnyFtpd 0wns j0

From: joe smith (joe_at_joesmith.homeip.net)
Date: 09/23/04

  • Next message: GuidoZ: "Re: [Full-Disclosure] Rootkit For Spyware? Hide your adware from all Adware removers and Anti-viruses" 
    To: Ryan Sumida <rsumida@csulb.edu>
Date: Thu, 23 Sep 2004 16:22:05 -0500

    You can try scanning it if you have the file.
    http://virusscan.jotti.dhs.org

    Ryan Sumida wrote:

    >
    > Thank you all for the help, I definitily appreciate it. The last
    > system I checked had ftp running on port 15708 which makes me believe
    > it is not the WORM_KIBUV.B but a similar variant. Sorry for the
    > unnecessary post, I googled the whole string which didn't come back
    > with anything. I should have just googled "StnyFtpd".
    >
    > Thanks again,
    >
    > Ryan
    >
    > full-disclosure-admin@lists.netsys.com wrote on 09/23/2004 10:42:13 AM:
    >
    > >
    > > I've been finding a few compromised Windows systems on our campus that
    > > have a random port open with a banner of "220 0wns j0". All
    > > the systems seem to be doing SYN scans on port 445 and LSASS buffer
    > > overflow attempts. Anyone know what worm/bot is doing this? I don't
    > > have access to these machines so I can only get a network view of what
    > > the systems are doing.
    > >
    > > Thanks,
    > >
    > > Ryan

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

  • Next message: GuidoZ: "Re: [Full-Disclosure] Rootkit For Spyware? Hide your adware from all Adware removers and Anti-viruses"