Trojan Port

[bobo0605]

Hello, I am doing some Vulnerability scan on the internal network using Angry IP and GFI Languard. I ran into a couple of 2003 servers with SP2 that had port 808 (Winhole) and some other ports that were open. I configured ipsec on these server and enabled the firewall and ran the security configuration app. I cannot get this port to close, the other ports are not showing up as vulnerabilities anymore so i think everything is configured right. Also, the security configuration is showin these ports as being blocked but the scanners tell a different story. Any idead here would be appreciated!!

 

[kmcferrin]

What is listening on those ports? Do a "netstat -b" and see what the program is.

 

[bobo0605]

I ran netstat -b and didn't see port 808 however i did run netstat -a and saw port 8081 listening on itself.

 

[lhuegele]

winhole is a trojan - What sort of anti-virus / anti-malware softare are you running on that server?

 

[bobo0605]

I'm running McAfee

 

[reynolwi]

i would look into another virus program and run it on that server and see what it comes up with. We use Sophos (

http://www.sophos.com)

and it has caught everything before it even installed. We even added their puremessage software which is the antivirus for exchange 2003.

Some users swear by McAfee but its not the greatest. In my opinion it doesnt do the greatest at scanning.



Wm. Reynolds
RRWDS | TxPSS

http://www.rrwds.com

http://www.txpubsafety.com

- - - - - - - - - - - - -
Network Error:
Hit any user to continue

 

[reynolwi]

Check this page out. It might help you see how well McAfee is doing.

http://sophos.com/products/free-tools/sophos-threat-detection-test.html

Wm. Reynolds
RRWDS | TxPSS

http://www.rrwds.com

http://www.txpubsafety.com

- - - - - - - - - - - - -
Network Error:
Hit any user to continue

 

[bobo0605]

I will give it a try, I tried some other software and did't find anything. The port 8081 i found out that McAfee was using.

 

[kmcferrin]

That's correct. McAfee uses port 8081 for the ePO client I believe. If you go to

http://localhost:8081

you should see the ePO log.

 

[bobo0605]

I ran sophos and it didn't detect anything. Not sure what to do next.