Re: Trojan of somesort

[Greg Bolshaw <greg () linuxtechnologies co uk>]

Bob the Builder wrote:
> I am currently doing an investigation into a compromised system. Before 
> pulling the plug I netcatted to a suspicous open port and received the 
> following banner:
>          220 SiGN - FR33-FXP3rs - On Da FUcKiNG C@S£!!!
> I am presuming this to be the welcome banner for a trojan horse of some 
> sort. Has anybody seen this before or does anybody know anything about 
> it or what Trojan this might be?

It's issuing a 220 - that's the welcome code for SMTP. Try sending a 
HELO or EHLO. If it responds with a 250, my bet is it's running as an 
open relay.

--
Greg Bolshaw <greg () linuxtechnologies co uk>
Consultant
Linux Technologies
http://www.linuxtechnologies.co.uk/

Attachment: signature.asc
Description: OpenPGP digital signature