commplex-link and other services

Pablo Lemos · #1 14th February 2007, 11:28 AM

Hi everybody!!

Recently i have detected some "strangers" services in my machine. There are:

5001/tcp open commplex-link
5050/tcp open mmcc

The first one seems is a trojan and the other a multimedia service. I dont know how i disable both?

Can someone help me??

Thanks a lot

InKo · #2 14th February 2007, 12:26 PM

do you have a firewall? iptables?

you can disable both with IPTables.

InKo · #3 14th February 2007, 12:30 PM

sorry, I misunderstood you...

did you scan your machine with a tool like nmap or you just find it in /etc/services?

Pablo Lemos · #4 14th February 2007, 01:07 PM

Thanks for the reply.

I scan my PC with a nmap local and with a nmap in other machine in my LAN.... I prefer eliminate the software rather than block it with iptables.

lsof -i output:

3 1599 root 3u IPv4 4690 TCP *:mmcc (LISTEN)
3 1601 root 3u IPv4 4688 TCP *:teldn (LISTEN)
portmap 1873 rpc 3u IPv4 5218 UDP *:sunrpc
portmap 1873 rpc 4u IPv4 5228 TCP *:sunrpc (LISTEN)
sshd 2131 root 3u IPv6 5526 TCP *:ssh (LISTEN)
mysqld 2278 mysql 10u IPv4 5671 TCP *:mysql (LISTEN)
mysqld 2278 mysql 64u IPv4 2992956 TCP localhost:mysql->localhost:35402 (ESTABLISHED)
mysqld 2278 mysql 65u IPv4 2992958 TCP localhost:mysql->localhost:36987 (ESTABLISHED)
sshd 15555 root 3u IPv6 2968907 TCP bioinfo:ssh->xxx.xxx.xxx.xxx:gwha (ESTABLISHED)
sshd 15558 plemos 3u IPv6 2968907 TCP bioinfo:ssh->xxx.xxx.xxx.xxx:gwha (ESTABLISHED)
httpd 16611 root 4u IPv6 2991826 TCP *:http (LISTEN)
httpd 16611 root 6u IPv6 2991831 TCP *:https (LISTEN)
httpd 16618 apache 4u IPv6 2991826 TCP *:http (LISTEN)
httpd 16618 apache 6u IPv6 2991831 TCP *:https (LISTEN)
httpd 16618 apache 21u IPv4 2992947 TCP localhost:36876->localhost:8009 (ESTABLISHED)
httpd 16619 apache 4u IPv6 2991826 TCP *:http (LISTEN)
httpd 16619 apache 6u IPv6 2991831 TCP *:https (LISTEN)
httpd 16619 apache 21u IPv4 2993077 TCP localhost:36880->localhost:8009 (ESTABLISHED)
httpd 16620 apache 4u IPv6 2991826 TCP *:http (LISTEN)
httpd 16620 apache 6u IPv6 2991831 TCP *:https (LISTEN)
httpd 16620 apache 21u IPv4 2993080 TCP localhost:36881->localhost:8009 (ESTABLISHED)
httpd 16621 apache 4u IPv6 2991826 TCP *:http (LISTEN)
httpd 16621 apache 6u IPv6 2991831 TCP *:https (LISTEN)
httpd 16621 apache 21u IPv4 2992944 TCP localhost:36875->localhost:8009 (ESTABLISHED)
httpd 16622 apache 4u IPv6 2991826 TCP *:http (LISTEN)
httpd 16622 apache 6u IPv6 2991831 TCP *:https (LISTEN)
httpd 16622 apache 21u IPv4 2993074 TCP localhost:36879->localhost:8009 (ESTABLISHED)
httpd 16623 apache 4u IPv6 2991826 TCP *:http (LISTEN)
httpd 16623 apache 6u IPv6 2991831 TCP *:https (LISTEN)
httpd 16623 apache 21u IPv4 2993083 TCP localhost:36882->localhost:8009 (ESTABLISHED)
httpd 16624 apache 4u IPv6 2991826 TCP *:http (LISTEN)
httpd 16624 apache 6u IPv6 2991831 TCP *:https (LISTEN)
httpd 16624 apache 21u IPv4 2993071 TCP localhost:36878->localhost:8009 (ESTABLISHED)
httpd 16625 apache 4u IPv6 2991826 TCP *:http (LISTEN)
httpd 16625 apache 6u IPv6 2991831 TCP *:https (LISTEN)
httpd 16625 apache 21u IPv4 2993068 TCP localhost:36877->localhost:8009 (ESTABLISHED)
java 16849 root 10u IPv6 2992736 TCP *:webcache (LISTEN)
java 16849 root 15u IPv6 2992827 TCP *:commplex-link (LISTEN)
java 16849 root 23u IPv6 2992830 TCP *:8009 (LISTEN)
java 16849 root 24u IPv6 2992831 TCP localhost:8005 (LISTEN)
java 16849 root 25u IPv6 2992833 TCP localhost:8009->localhost:36875 (ESTABLISHED)
java 16849 root 26u IPv6 2992945 TCP localhost:8009->localhost:36876 (ESTABLISHED)
java 16849 root 27u IPv6 2992948 TCP localhost:8009->localhost:36877 (ESTABLISHED)
java 16849 root 28u IPv6 2992955 TCP localhost:35402->localhost:mysql (ESTABLISHED)
java 16849 root 29u IPv6 2992957 TCP localhost:36987->localhost:mysql (ESTABLISHED)
java 16849 root 30u IPv6 2993069 TCP localhost:8009->localhost:36878 (ESTABLISHED)
java 16849 root 31u IPv6 2993072 TCP localhost:8009->localhost:36879 (ESTABLISHED)
java 16849 root 32u IPv6 2993075 TCP localhost:8009->localhost:36880 (ESTABLISHED)
java 16849 root 33u IPv6 2993078 TCP localhost:8009->localhost:36881 (ESTABLISHED)
java 16849 root 35u IPv6 2993081 TCP localhost:8009->localhost:36882 (ESTABLISHED)
httpd 17620 apache 4u IPv6 2991826 TCP *:http (LISTEN)
httpd 17620 apache 6u IPv6 2991831 TCP *:https (LISTEN)
httpd 18018 apache 4u IPv6 2991826 TCP *:http (LISTEN)
httpd 18018 apache 6u IPv6 2991831 TCP *:https (LISTEN)

nmap output:

Starting Nmap 4.00 ( http://www.insecure.org/nmap/ ) at 2007-02-14 14:06 CET
Interesting ports on localhost (127.0.0.1):
(The 1663 ports scanned but not shown below are in state: closed)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
111/tcp open rpcbind
443/tcp open https
3306/tcp open mysql
5001/tcp open commplex-link
5050/tcp open mmcc
8009/tcp open ajp13
8080/tcp open http-proxy

Thanks