Security Incidents: Re: Trojan of somesort

[Brian Eckman <eckman () umn edu>]

Bob the Builder wrote:
> Hi,
> I am currently doing an investigation into a compromised system. Before 
> pulling the plug I netcatted to a suspicous open port and received the 
> following banner:
>          220 SiGN - FR33-FXP3rs - On Da FUcKiNG C () S£!!!
> I am presuming this to be the welcome banner for a trojan horse of some 
> sort. Has anybody seen this before or does anybody know anything about 
> it or what Trojan this might be?
I haven't seen that exact banner before. My first guess would be its an 
FTP server.
Brian
--
Brian Eckman
Security Analyst
OIT Security and Assurance
University of Minnesota