Re: Trojan of somesort

[MATT GIBSON <mattgibson () shaw ca>]

> > Bob the Builder wrote:
> > I am currently doing an investigation into a compromised system. 
> > Before pulling the plug I netcatted to a suspicous open port and 
> > received the following banner:
> >          220 SiGN - FR33-FXP3rs - On Da FUcKiNG C@S£!!!
> > I am presuming this to be the welcome banner for a trojan horse of 
> > some sort. Has anybody seen this before or does anybody know anything 
> > about it or what Trojan this might be?

> It's issuing a 220 - that's the welcome code for SMTP. >Try sending a HELO or EHLO. If it responds with a 250, >my bet 
> is it's running as an open relay.

I'd actually say it's more likely that it's an FTP server, since these are built into many of the latest trojans and 
rootkits.

-Matt