Help! NetBus on port 12345

herc · 12-09-2003, 08:13 AM

Quote:

# nmap localhost

Starting nmap V. 3.00 ( www.insecure.org/nmap/ )
Interesting ports on localhost (127.0.0.1):
(The 1590 ports scanned but not shown below are in state: closed)
Port State Service
21/tcp open ftp
22/tcp open ssh
80/tcp open http
111/tcp open sunrpc
113/tcp open auth
631/tcp open ipp
3306/tcp open mysql
3333/tcp open dec-notes
6000/tcp open X11
7000/tcp open afs3-fileserver
12345/tcp open NetBus

Nmap run completed -- 1 IP address (1 host up) scanned in 3 seconds

Help needed, how can I remove it, is it a trojan?

yuray · 12-09-2003, 08:23 AM

Start
netstat -a -p -n |grep 12345
and you must see file name of program

herc · 12-09-2003, 08:25 AM

hehe, false alarm, it was my friends psybnc in port 12345

Thanks for the help tho!

chort · 12-09-2003, 08:44 AM

By the way, check from the outside instead of scanning localhost. If sunrpc, ipp, mysql, and x11 are open from the outside you have some problems.