ServMe trojan found on port 5555

[Marilyn Rapp]

What can be done about the ServMe trojan that has been found on port 5555? We use omniback to make backups to a 48 tape jukebox.

Is there a patch or security measure that can take care of this problem.

My servers are HP-UX 11.0 D and K class with Oracle db and Psoft apps running on them along with various other apps.



Thanks,
Marilyn
HP Sys Admin

[Jeff Schussele · Accepted solution]

Hi Marilyn,

Appears to be a Windoze specific problem. Sets up a Trojan FTP server on M$ boxes.

Here's some specifics:

Name: ServeMe
Aliases:
Ports: 5555
Files: Serveme.zip - 35,169 bytes Servemegui.zip - 37,824 bytes Magic.exe - 69,632 bytes Sm tgui.exe - 45,056 bytes Wintlb.exe -
Created: May 1999
Requires:
Actions: FTP server.
Versions:
Registers: HKEY_LOCAL_MACHINE\SoftwareMicrosoftWindowsCurrentVersionRunServices\
Notes: Works on Windows 95 and 98. Source code is available.
Country:
Lenguage: Written in Visual Basic 5.0.

Don't think it should be a problem on HP-UX systems.

Rgds,
Jeff

[A. Clay Stephenson]

There would only be a potential problem if you are also connecting to Windows OB2 clients. You could change from the default port of 5555 but there is of course no guarantee that another port is not used by another trojan horse. I can tell you that I have run in a mixed UNIX/Novell/Windows OB2 cell on port 5555 for a long time without problems. I assume your are running some sort of Corporate Anti-Virus software and keep the signature files updated.

[Mark Fenton]

I echo Clay's remarks. We have a rather smallish system (110 Windoze clients, 1 HPUX server and several Win Servers) behind a firewall and running anti-virus, etc. And use OB for all our backup with no incident to date.

I don't think it's really much of an issue if you keep your defenses current, and limit where on the network traffic is allowed on which port.

Best regards,
Mark