strange ftp site

From: info hunter (sp3ct0r_at_yahoo.com)
Date: 10/30/03

  • Next message: Thomas Springer: "Random 2packet-probes on port 445" 
    Date: 30 Oct 2003 15:24:15 -0000
To: incidents@securityfocus.com
    ('binary' encoding is not supported, stored as-is)

    Excuse my ignorance but need some help here.
    Anyone know anything about this ftp site ftp://66.159.219.196
    Noticed a firewall log showing a system hitting this address . Their seems to be an exe and and some dll's. When running the exe a dialog box named test pops up and displays the text "if you can see this, email eric".
    Sam spade showed a badly configured dns. Would appreciate any input on this. It may be completly benign or maybe even just legit. Just seems strange or I may be just paranoid.

    ---------------------------------------------------------------------------
    Network with over 10,000 of the brightest minds in information security
    at the largest, most highly-anticipated industry event of the year.
    Don't miss RSA Conference 2004! Choose from over 200 class sessions and
    see demos from more than 250 industry vendors. If your job touches
    security, you need to be here. Learn more or register at
    http://www.securityfocus.com/sponsor/RSA_incidents_031023
    and use priority code SF4.
    ----------------------------------------------------------------------------

  • Next message: Thomas Springer: "Random 2packet-probes on port 445"

    Relevant Pages

    • RE: strange ftp site
      ... Here are some quick prelim results of running strings against the exe file. ... A security error of unknown cause has been detected which has ... Network with over 10,000 of the brightest minds in information security ... most highly-anticipated industry event of the year. ...
      (Incidents)
    • RE: CEH and Intense School
      ... Q-How many times has this course been delivered ... You want more than 4 to know the bugs are ironed out in labs and so on. ... Network with over 10,000 of the brightest minds in information security ... most highly-anticipated industry event of the year. ...
      (Pen-Test)
    • RE: Probable Trojan.
      ... Network with over 10,000 of the brightest minds in information security ... most highly-anticipated industry event of the year. ... Don't miss RSA Conference 2004! ... Choose from over 200 class sessions and ...
      (Incidents)
    • Re: strange ftp site
      ... >Network with over 10,000 of the brightest minds in information security ... most highly-anticipated industry event of the year. ... Learn more or register at ... >and use priority code SF4. ...
      (Incidents)
    • Re: Pen-testing remote VPN services over IP
      ... Check out IKEcrack from Anton Rager. ... >Chris McNab ... >Network with over 10,000 of the brightest minds in information security ... most highly-anticipated industry event of the year. ...
      (Pen-Test)