LITTLEBLACKDOG.COM

Posted: Tue Apr 18, 2006 11:01 am Post subject: callbook process on port 2000

what is it, and hwo do I get rid of it? I have had absolutely no luck as to waht this is, or why it'running, let alone how to reomove it.

And since our FTP runs on this por t(for some reason), I need to get it running ASAP Sad

Help

Posted: Tue Apr 18, 2006 11:29 am Post subject:

cisco VoIP software is callbook

known remote access and trojans run on 2000 also

Never used callbook, but one would assume it's tied into some Cisco management app or something, if not a standalone.

Posted: Tue Apr 18, 2006 11:33 am Post subject:

Olive wrote:
cisco VoIP software is callbook

known remote access and trojans run on 2000 also

Never used callbook, but one would assume it's tied into some Cisco management app or something, if not a standalone.

hmm...well since I know that we don't use any cisco products, sounds like I've got a virus on my hands. Thanks

Posted: Tue Apr 18, 2006 11:34 am Post subject:

are you sure callbook is actually using this port? or did you just assume that because it's 2000, it's callbook?

http://www.sysinternals.com/Utilities/TcpView.html
http://www.sysinternals.com/Utilities/TdiMon.html

Posted: Tue Apr 18, 2006 11:45 am Post subject:

creed wrote:
hmm...well since I know that we don't use any cisco products, sounds like I've got a virus on my hands. Thanks

I'd run TCP view and see if you can determine which process is using that port. Some remote access product also use that port. It could be as simple as killing that app, or forcing it to another port, and not a trojan at all.

Posted: Tue Apr 18, 2006 8:26 pm Post subject:

Olive wrote:
are you sure callbook is actually using this port? or did you just assume that because it's 2000, it's callbook?

http://www.sysinternals.com/Utilities/TcpView.html
http://www.sysinternals.com/Utilities/TdiMon.html

well when I used nmap (which btw should come default with windows, it's a handy tool), it comes up as callbook as the prot or protocol being used.

SInce I've got no idea what the heck callbook is, figured it was either some software I've never heard of, or a proptocol that I'm unfamiliar with.

Found out it was a virus using our server for an ftp. How nice. ALl fixed now and working great Very Happy

Mutt Joined: 10 Apr 2002 Posts: 121 Location: USA

That was me using your box to crunch

Twisted Evil

You got me. Just kidding Glad to hear you fixed it.