Full Disclosure mailing list archives
Re: unknown backdoor: 220 StnyFtpd 0wns j0
From: joe smith <joe () joesmith homeip net>
Date: Thu, 23 Sep 2004 16:22:05 -0500
You can try scanning it if you have the file. http://virusscan.jotti.dhs.org
Ryan Sumida wrote:
Thank you all for the help, I definitily appreciate it. The last system I checked had ftp running on port 15708 which makes me believe it is not the WORM_KIBUV.B but a similar variant. Sorry for the unnecessary post, I googled the whole string which didn't come back with anything. I should have just googled "StnyFtpd".Thanks again, Ryan full-disclosure-admin () lists netsys com wrote on 09/23/2004 10:42:13 AM: > > I've been finding a few compromised Windows systems on our campus that > have a random port open with a banner of "220 0wns j0". All > the systems seem to be doing SYN scans on port 445 and LSASS buffer > overflow attempts. Anyone know what worm/bot is doing this? I don't > have access to these machines so I can only get a network view of what > the systems are doing. > > Thanks, >> Ryan
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- unknown backdoor: 220 StnyFtpd 0wns j0 Ryan Sumida (Sep 23)
- Re: unknown backdoor: 220 StnyFtpd 0wns j0 Harlan Carvey (Sep 23)
- Re: unknown backdoor: 220 StnyFtpd 0wns j0 joe smith (Sep 23)
- Re: unknown backdoor: 220 StnyFtpd 0wns j0 Ryan Sumida (Sep 23)
- Re: unknown backdoor: 220 StnyFtpd 0wns j0 joe smith (Sep 23)
- Re: unknown backdoor: 220 StnyFtpd 0wns j0 Mike Iglesias (Sep 23)
- <Possible follow-ups>
- RE: unknown backdoor: 220 StnyFtpd 0wns j0 Todd Towles (Sep 23)
- Re: unknown backdoor: 220 StnyFtpd 0wns j0 mike king (Sep 23)
- RE: unknown backdoor: 220 StnyFtpd 0wns j0 Elliott, James (Sep 23)
- RE: unknown backdoor: 220 StnyFtpd 0wns j0 Fowler, Mike (Sep 23)
- RE: unknown backdoor: 220 StnyFtpd 0wns j0 Constantinidis, Alex (Sep 24)