Group 500 probably infected

Anonymous · ‎02-13-2018

Hi,

one of our RealPresence Group 500 was in the DMZ for some unknown reason for long time with telnet enabled. As it has been moved behind the firewall we found that It has abnormal activity on the lan. It tries to connet random external IPs on port 5555 with over 100 times per second.

Is there any way to kill malware process without hard reset?

SteffenBaierUK · ‎02-13-2018

Hello @Aleksei,

welcome to the Polycom Community.

The first thing you should do is factory restore the unit itself and then monitor it.

If someone had access to it for an unknown duration there may still be some backdoor.

Please ensure to provide some feedback if this reply has helped you so other users can profit from your experience.

Best Regards

Steffen Baier

Polycom Global Services

------------------------------------------------
Notice: I am an HP Poly employee but all replies within the community are done as a volunteer outside of my day role. This community forum is not an official HP Poly support resource, thus responses from HP Poly employees, partners, and customers alike are best-effort in attempts to share learned knowledge.
If you need immediate and/or official assistance for former Poly\Plantronics\Polycom please open a service ticket through your support channels
For HP products please check HP Support.

Please also ensure you always check the General VoIP , Video Endpoint , UC Platform (Microsoft) , PSTN

Anonymous · ‎02-13-2018

Thank you, SteffenBaierUK! As expected soft reset does't helped but hard reset via pinhole solved the problem.

Create an account on the HP Community to personalize your profile and ask a question