Security Incidents mailing list archives
Re: Troyan in port 25 ???
From: Jackal <-jackal- () LIBERO IT>
Date: Thu, 14 Dec 2000 09:58:42 +0100
Trojan Deafult port list... Port 25 Ajan, Antigen, Email Password Sender, Gip, Haebu Coceda (=Naebi), Happy 99, I Love You, Kaung2, Pro Mail Trojan, Shtrilitz, Stealth, Tapiras, Terminator, WinPC, WinSpy รน It should be one of this... Kindly Regards The Jackal ----- Original Message ----- From: <peter () FRIENDS COM> To: <INCIDENTS () SECURITYFOCUS COM> Sent: Wednesday, December 13, 2000 12:03 PM Subject: Troyan in port 25 ???
Does anyone known about a Troyan listening at port 25? The Operating System is a WIN NT 4 w/SP6a. We installed a WINNT 4.0. After that we installed service pack 6a and a software for chat-server called "digichat". Yesterday I tried to start a SMTP SERVER but the software gave me an
error,
because the port 25 was begging used by other application. Then i connect to that port and I receive this "♥ ⁿ↓ ⁿ↓
ⁿ↓☺☻♥@☻`☺☺ ⁿ↓ ⁿ↓ ⁿ↓☺☺"
chain of data and the connection was not closed. Because I din't
recongnise
any inet service using this code, I suppossed that may be a troyan. I was thinking that may be the "Digichat" software the one using that
port,
but after I stopped all services (including IIS note that SMTP service was not installed), i realize that the port still was open. Anyone have any information about this. Thank you in advance ! :) _________________________________________________________ This message was sent with Sendpad.com. The sender indicated his or her e-mail address as "peter () friends com" Send anonymous e-mail right now at http://www.sendpad.com
Current thread:
- Troyan in port 25 ??? peter (Dec 14)
- Re: Troyan in port 25 ??? Matt Rose (Dec 15)
- Re: Troyan in port 25 ??? Jackal (Dec 15)