topic Re: ServMe trojan found on port 5555 in Operating System - HP-UX

ServMe trojan found on port 5555

Marilyn Rapp — Fri, 21 Jun 2002 20:02:41 GMT

What can be done about the ServMe trojan that has been found on port 5555? We use omniback to make backups to a 48 tape jukebox.

Is there a patch or security measure that can take care of this problem.

My servers are HP-UX 11.0 D and K class with Oracle db and Psoft apps running on them along with various other apps.

Thanks,
Marilyn
HP Sys Admin

Re: ServMe trojan found on port 5555

Jeff Schussele — Fri, 21 Jun 2002 20:22:48 GMT

Hi Marilyn,

Appears to be a Windoze specific problem. Sets up a Trojan FTP server on M$ boxes.

Here's some specifics:

Name: ServeMe
Aliases:
Ports: 5555
Files: Serveme.zip - 35,169 bytes Servemegui.zip - 37,824 bytes Magic.exe - 69,632 bytes Sm tgui.exe - 45,056 bytes Wintlb.exe -
Created: May 1999
Requires:
Actions: FTP server.
Versions:
Registers: HKEY_LOCAL_MACHINE\SoftwareMicrosoftWindowsCurrentVersionRunServices\
Notes: Works on Windows 95 and 98. Source code is available.
Country:
Lenguage: Written in Visual Basic 5.0.

Don't think it should be a problem on HP-UX systems.

Rgds,
Jeff

Re: ServMe trojan found on port 5555

A. Clay Stephenson — Fri, 21 Jun 2002 21:05:33 GMT

There would only be a potential problem if you are also connecting to Windows OB2 clients. You could change from the default port of 5555 but there is of course no guarantee that another port is not used by another trojan horse. I can tell you that I have run in a mixed UNIX/Novell/Windows OB2 cell on port 5555 for a long time without problems. I assume your are running some sort of Corporate Anti-Virus software and keep the signature files updated.

Re: ServMe trojan found on port 5555

Mark Fenton — Fri, 21 Jun 2002 22:13:35 GMT

I echo Clay's remarks. We have a rather smallish system (110 Windoze clients, 1 HPUX server and several Win Servers) behind a firewall and running anti-virus, etc. And use OB for all our backup with no incident to date.

I don't think it's really much of an issue if you keep your defenses current, and limit where on the network traffic is allowed on which port.

Best regards,
Mark