full-disclosure - unknown backdoor: 220 StnyFtpd 0wns j0

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

From: alex.constantinidis at csfb.com (Constantinidis, Alex)
Subject: unknown backdoor: 220 StnyFtpd 0wns j0

It sounds like the KIBUV.B worm
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_KIBUV.B
<http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_KIBUV.B&VSect=T>
&VSect=T
 
Regards,
 
Alex

-----Original Message-----
From: full-disclosure-admin@...ts.netsys.com
[mailto:full-disclosure-admin@...ts.netsys.com]On Behalf Of Ryan Sumida
Sent: 23 September 2004 18:42
To: full-disclosure@...ts.netsys.com
Subject: [Full-Disclosure] unknown backdoor: 220 StnyFtpd 0wns j0



I've been finding a few compromised Windows systems on our campus that have a
random port open with a banner of "220 StnyFtpd 0wns j0".  All the systems
seem to be doing SYN scans on port 445 and LSASS buffer overflow attempts.
Anyone know what worm/bot is doing this?  I don't have access to these
machines so I can only get a network view of what the systems are doing. 

Thanks, 

Ryan


==============================================================================
This message is for the sole use of the intended recipient. If you received
this message in error please delete it and notify us. If this message was
misdirected, CSFB does not waive any confidentiality or privilege. CSFB
retains and monitors electronic communications sent through its network.
Instructions transmitted over this system are not binding on CSFB until they
are confirmed by us. Message transmission is not guaranteed to be secure.
==============================================================================
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040924/af126b79/attachment.html