What is Well-known TCP Port 999 for?

[chucksel]

I noticed that I have port 999 open on a machine. What uses this port? I see that it is kisted as being for:

garcon 999/tcp
applix 999/udp Applix ac
puprouter 999/tcp
puprouter 999/udp


What are these apps/services?

Thanks! Chuck, MCSE

 

[WheeDoggy]

Assumng that you don't have Applix on the machine,
I would recommend virus scanning as this may likely be the keylogging service of the DeepThroat trojan.
Check also :6667 for trace of SubSeven.

Let me know if this proves useful.

 

[chucksel]

WheeDoggy,

Thanks for the reply.

Well, I would hope that the latest engine and pattern (455) for my Trend Micro ServerProtect virus scanner that is running on this particular machine would catch this.

I am not running Applix on this Win2K server (at least I do not think so). What is Applix and how can I check? Chuck, MCSE

 

[WheeDoggy]

You can check out Applix here:

http://www.applix.com/index.asp

You might want to try some of the free online virus scans - Local virus scanners can become compromised and rendered ineffective. Trend Micro (

http://housecall.trendmicro.com/

) has a free online along with Symantec (

http://www.symantec.com

) and McAfee FreeScan (

http://www.mcafee.com

).

I would advise firing up regedt32 and seeing if any strange programs are in the startup list (possibly systempatch.exe): HKLM\Software\Microsoft\Windows\CurrentVersion\Run

Let me know how it goes.

Rgds

 

[chucksel]

Nothing irregular in the HKLM\Software\Microsoft\Windows\CurrentVersion\Run hive.

Hmmmmmmmmmm. Chuck, MCSE

 

[WheeDoggy]

No Applix? If not you might want to block the tcp/udp 999 service with tcp filter/firewall as I am hard pressed to find any useful service other than Applix.

Have you tried the online virus scan yet?

FYI, other known SubSevens that use port 999 - f0replay & WinSatan.

Check the Run/RunServices keys in the reg under HKCU hive. Also check your CONFIG.SYS, AUTOEXEC.BAT, WINSTART.BAT, WIN.INI, for any strange apps loading.

Let us know........

 

[WheeDoggy]

Geez, forgot one key thing - *SMACK* - OK I'm awake now!

Check firewall logs which should show which app is using port 999.
If nothing revealed here, the following will reveal what is going on:

http://www.sysinternals.com/ntw2k/freeware/tdimon.shtml

Rgds

 

[SgtB]

Fport will work nicely as well...

http://www.foundstone.com/knowledge/proddesc/fport.html

________________________________________
Check out

http://www.security-forums.com