Full Disclosure mailing list archives
RE: unknown backdoor: 220 StnyFtpd 0wns j0
From: "Todd Towles" <toddtowles () brookshires com>
Date: Thu, 23 Sep 2004 13:14:02 -0500
Could be a variant of the Win32/kibuv.b worm http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_KIB UV.B&VSect=T Maybe it scans for the LSASS buffer overflow. Is there a FTP server on 7955? a backdoor on 420? This worm also tries to connect to a IRC channel via port 6667 ________________________________ From: full-disclosure-admin () lists netsys com [mailto:full-disclosure-admin () lists netsys com] On Behalf Of Ryan Sumida Sent: Thursday, September 23, 2004 12:42 PM To: full-disclosure () lists netsys com Subject: [Full-disclosure] unknown backdoor: 220 StnyFtpd 0wns j0 I've been finding a few compromised Windows systems on our campus that have a random port open with a banner of "220 StnyFtpd 0wns j0". All the systems seem to be doing SYN scans on port 445 and LSASS buffer overflow attempts. Anyone know what worm/bot is doing this? I don't have access to these machines so I can only get a network view of what the systems are doing. Thanks, Ryan
Current thread:
- unknown backdoor: 220 StnyFtpd 0wns j0 Ryan Sumida (Sep 23)
- Re: unknown backdoor: 220 StnyFtpd 0wns j0 Harlan Carvey (Sep 23)
- Re: unknown backdoor: 220 StnyFtpd 0wns j0 joe smith (Sep 23)
- Re: unknown backdoor: 220 StnyFtpd 0wns j0 Ryan Sumida (Sep 23)
- Re: unknown backdoor: 220 StnyFtpd 0wns j0 joe smith (Sep 23)
- Re: unknown backdoor: 220 StnyFtpd 0wns j0 Mike Iglesias (Sep 23)
- <Possible follow-ups>
- RE: unknown backdoor: 220 StnyFtpd 0wns j0 Todd Towles (Sep 23)
- Re: unknown backdoor: 220 StnyFtpd 0wns j0 mike king (Sep 23)
- RE: unknown backdoor: 220 StnyFtpd 0wns j0 Elliott, James (Sep 23)
- RE: unknown backdoor: 220 StnyFtpd 0wns j0 Fowler, Mike (Sep 23)
- RE: unknown backdoor: 220 StnyFtpd 0wns j0 Constantinidis, Alex (Sep 24)