Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Register a free account to unlock additional features at BleepingComputer.com

Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Latest News: New ErrTraffic service enables ClickFix attacks via fake browser glitches

Featured Deal: This PDF editor alternative is only $40 for a lifetime subscription

Latest Buyer's Guide: Best VPNs in 2025

Trojans and BackOrifice

Started by DAngelo , May 05 2025 06:28 AM

This topic is locked

5 replies to this topic

#1 DAngelo

Members
13 posts
OFFLINE

Local time:02:19 AM

Posted 05 May 2025 - 06:28 AM

I have been trying to figure out what was in my computer for 6 months. I have reinstalled repeatedly, Installed new routers, and installed nordVPN. After a reinstall, it is quite for a few days then the cpu racing signified it was back. Nothing ever detects it not Norton, Windows defender Malwarebytes, nor a few other. While taking some classes online to help me harden windows, I tried this nmap command and it returned

C:\Program Files (x86)\Nmap\scripts>nmap -sC scanme.nmap.org

Starting Nmap 7.95 ( https://nmap.org ) at 2025-05-05 05:36 Central Daylight Time

Nmap scan report for scanme.nmap.org (45.33.32.156)

Host is up (0.064s latency).

Not shown: 990 closed tcp ports (reset)

PORT STATE SERVICE

22/tcp open ssh

| ssh-hostkey:

| 256 96:02:bb:5e:57:54:1c:4e:45:2f:56:4c:4a:24:b2:57 (ECDSA)

|_ 256 33:fa:91:0f:e0:e1:7b:1f:6d:05:a2:b0:f1:54:41:56 (ED25519)

25/tcp filtered smtp

53/tcp open domain

| dns-nsid:

|_ bind.version: dnsmasq-UNKNOWN

80/tcp open http

|_http-title: Go ahead and ScanMe!

|_http-favicon: Nmap Project

111/tcp filtered rpcbind

135/tcp filtered msrpc

139/tcp filtered netbios-ssn

445/tcp filtered microsoft-ds

9929/tcp open nping-echo

31337/tcp open Elite

An internet search of "what is 31337/tcp open Elite" returned:

Trojans and BackOrifice

31337/tcp open Elite is a port that is associated with trojans and BackOrifice, which is a backdoor hack tool. If you see this port open on your server, it means that your server has been compromised and is running a rogue service. The standard advice in this situation is to backup your database and rebuild the server from scratch.

My question is how to remove this (I have already reset using the options to erase everything and download from the cloud, repeatedly)

Back to top

BC AdBot (Login to Remove)

BleepingComputer.com
Register to remove ads

#2 quietman7

Bleepin' Gumshoe

Global Moderator
65,330 posts
OFFLINE

Gender:Male
Location:Virginia, USA
Local time:02:19 AM

Posted 05 May 2025 - 06:50 AM

If you need individual assistance from our experts with finding/removing a possible malware infection, checking for possible hacking or just need a second opinion, there are advanced tools which can be used to investigate but they are not permitted in this forum. If you need such help, please follow the instructions in the Malware Removal and Log Section Preparation Guide. After doing that, they should start a new topic and post their FRST logs in the Virus, Trojan, Spyware, and Malware Removal Logs Forum, NOT here, for assistance by the Malware Response Team.

If you choose to follow the above instructions, please reply back in this thread with a link to the new topic.

The BC Staff

.
.
Microsoft MVP Alumni 2023, Windows Insider MVP 2017-2020, MVP Reconnect 2016-2023

Microsoft MVP Consumer Security 2007-2015
Member of UNITE, Unified Network of Instructors and Trusted Eliminators
Retired Police Officer, Federal Agent and Coast Guard Chief

If I have been helpful & you'd like to consider a donation, click

Back to top

#3 DAngelo

Topic Starter

Members
13 posts
OFFLINE

Local time:02:19 AM

Posted 05 May 2025 - 07:36 AM

Thank you

Back to top

#4 quietman7

Bleepin' Gumshoe

Global Moderator
65,330 posts
OFFLINE

Gender:Male
Location:Virginia, USA
Local time:02:19 AM

Posted 05 May 2025 - 07:41 AM

You're welcome and good luck.

.
.
Microsoft MVP Alumni 2023, Windows Insider MVP 2017-2020, MVP Reconnect 2016-2023

Microsoft MVP Consumer Security 2007-2015
Member of UNITE, Unified Network of Instructors and Trusted Eliminators
Retired Police Officer, Federal Agent and Coast Guard Chief

If I have been helpful & you'd like to consider a donation, click

Back to top

#5 DAngelo

Topic Starter

Members
13 posts
OFFLINE

Local time:02:19 AM

Posted 05 May 2025 - 08:46 AM

I have opened a case at Trojans and BackOrifice - Virus, Trojan, Spyware, and Malware Removal Help

Back to top

#6 quietman7

Bleepin' Gumshoe

Global Moderator
65,330 posts
OFFLINE

Gender:Male
Location:Virginia, USA
Local time:02:19 AM

Posted 05 May 2025 - 03:00 PM

Since you are now receiving help from the Malware Response Team, you should NOT make further changes to your computer (install/uninstall programs, use special fix tools, delete files, edit the registry, etc) unless advised by a Malware Response Team member...nor should you continue to ask for help elsewhere. Doing so can result in system changes which may not show it the log(s) you already posted. Further, any modifications you make on your own may cause confusion for the member assisting you and could complicate the investigative process or make things worst which would extend the time it takes to clean your computer.

The Malware Response Team should be the only members that you take advice from, until they have verified your system is clean.

To avoid confusion, I am closing this topic.

Good luck.

The BC Staff

.
.
Microsoft MVP Alumni 2023, Windows Insider MVP 2017-2020, MVP Reconnect 2016-2023

Microsoft MVP Consumer Security 2007-2015
Member of UNITE, Unified Network of Instructors and Trusted Eliminators
Retired Police Officer, Federal Agent and Coast Guard Chief

If I have been helpful & you'd like to consider a donation, click