RE: unknown backdoor: 220 StnyFtpd 0wns j0

["Constantinidis, Alex" <alex.constantinidis () csfb com>]

It sounds like the KIBUV.B worm
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_KIBUV.B
<http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_KIBUV.B&VSect=T>
&VSect=T
 
Regards,
 
Alex

-----Original Message-----
From: full-disclosure-admin () lists netsys com
[mailto:full-disclosure-admin () lists netsys com]On Behalf Of Ryan Sumida
Sent: 23 September 2004 18:42
To: full-disclosure () lists netsys com
Subject: [Full-disclosure] unknown backdoor: 220 StnyFtpd 0wns j0



I've been finding a few compromised Windows systems on our campus that have a
random port open with a banner of "220 StnyFtpd 0wns j0".  All the systems
seem to be doing SYN scans on port 445 and LSASS buffer overflow attempts.
Anyone know what worm/bot is doing this?  I don't have access to these
machines so I can only get a network view of what the systems are doing. 

Thanks, 

Ryan


==============================================================================
This message is for the sole use of the intended recipient. If you received
this message in error please delete it and notify us. If this message was
misdirected, CSFB does not waive any confidentiality or privilege. CSFB
retains and monitors electronic communications sent through its network.
Instructions transmitted over this system are not binding on CSFB until they
are confirmed by us. Message transmission is not guaranteed to be secure.
==============================================================================