Rogue FTP Servers

[Elliott Franklin <franklin () TXSTATE EDU>]

We are experiencing a small number of compromised machines running FTP
servers on various non-standard ports.  The most recent port used was 6366
and we have located this on 30 machines.  I can't find anything on any of
the major virus sites to help us understand how this is occurring.  Anyone
else experiencing something similar?

Thanks!

Elliott Franklin, CISSP
Information Security Officer
Texas State University - San Marcos
http://www.txstate.edu/computing/security
512.245.2595

**********
Participation and subscription information for this EDUCAUSE Discussion Group discussion list can be found at 
http://www.educause.edu/groups/.