Re: Trojan of somesort

[Harlan Carvey <keydet89 () yahoo com>]

Matt,

I'm familiar w/ some of the Trojans/backdoors w/ FTP
capability, but can you provide some specific
information regarding rootkits that have this
capability?  Not *nix-based, but for Windows?


--- MATT GIBSON <mattgibson () shaw ca> wrote:
> > > Bob the Builder wrote:
> > > I am currently doing an investigation into a
> compromised system. 
> > > Before pulling the plug I netcatted to a
> suspicous open port and 
> > > received the following banner:
> > >          220 SiGN - FR33-FXP3rs - On Da FUcKiNG
> C@S£!!!
> > > I am presuming this to be the welcome banner for
> a trojan horse of 
> > > some sort. Has anybody seen this before or does
> anybody know anything 
> > > about it or what Trojan this might be?
>
> > It's issuing a 220 - that's the welcome code for
> SMTP. >Try sending a HELO or EHLO. If it responds
> with a 250, >my bet is it's running as an open
> relay.
>
> I'd actually say it's more likely that it's an FTP
> server, since these are built into many of the
> latest trojans and rootkits.
>
> -Matt