RE: Trojan of somesort

["Rob Shein" <shoten () starpower net>]

It looks like an FTP status reply.  The "220" indicated "Service ready for
new user".  What happens if you try to connect to it with an FTP client?

> -----Original Message-----
> From: Bob the Builder [mailto:builder173 () hotmail com] 
> Sent: Monday, May 24, 2004 4:30 AM
> To: incidents () securityfocus com
> Subject: Trojan of somesort
>
>
> Hi,
> I am currently doing an investigation into a compromised 
> system. Before 
> pulling the plug I netcatted to a suspicous open port and 
> received the 
> following banner:
>           220 SiGN - FR33-FXP3rs - On Da FUcKiNG C@S£!!!
> I am presuming this to be the welcome banner for a trojan 
> horse of some 
> sort. Has anybody seen this before or does anybody know 
> anything about it or 
> what Trojan this might be?
>
> Cheers,
>
> Bob
>
> _________________________________________________________________
> Get 200+ ad-free, high-fidelity stations and LIVE Major 
> League Baseball 
> Gameday Audio! 
> http://radio.msn.click-> url.com/go/onm00200491ave/direct/01/