Full Disclosure mailing list archives
RE: explorer.exe on port 1024 tcp
From: "Aditya" <aditya () mail15 com>
Date: Tue, 16 Sep 2003 01:35:59 +0530
in windows 1024 in not a restricted port any user can open up and start listining on any port... restricted port is a unix concept that ms forgot to copy... can u see some connection to explorer ? try netstat -a for this info most probebly nothing more that some useless open port that various windows programs have habit of opening up u say u have scanned ur system ... but did u update the antivirus definations ? ------ Aditya Lalit Deshmukh, _____ Chief Security Officer & System and Network Administrator, Electronic Security Division, Enterprise Security Solutions, Inc -----Original Message----- From: full-disclosure-admin () lists netsys com [mailto:full-disclosure-admin () lists netsys com]On Behalf Of Joel R. Helgeson Sent: Friday, September 12, 2003 6:13 PM To: full-disclosure () lists netsys com Subject: [Full-disclosure] explorer.exe on port 1024 tcp Can anyone tell me why I would be seeing explorer.exe on windows XP pro listening on port 1024 tcp? 1024 is a restricted port, I don't think that MS would ever use it legitamately. I'm thinking it's a trojan horse or something. In googling the problem, I discovered other users that are asking the same question with no answers. MS Site is no help. I went to the machine and telnetted to 127.0.0.1:1024 and it opened a connection where I couldn't type anything, so it IS listening. I copied explorer.exe off the machine, and scanned it with an AV pkg, no virus. I ran spyware cleanup utilities to no avial. Below is the output from fport on the machine... I have examined hundreds of other XP machines and none respond on port 1024 TCP & 123 UDP. FPort v2.0 - TCP/IP Process to Port Mapper Copyright 2000 by Foundstone, Inc. http://www.foundstone.com Pid Process Port Proto Path 432 Explorer -> 1024 TCP C:\WINDOWS\Explorer.EXE 432 Explorer -> 123 UDP C:\WINDOWS\Explorer.EXE 4 System -> 123 UDP Any insight into this would be appreciated. Joel R. Helgeson "Give a man fire, and he'll be warm for a day; set a man on fire, and he'll be warm for the rest of his life." _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Attachment:
Aditya Lalit Deshmukh.vcf
Description:
Current thread:
- explorer.exe on port 1024 tcp Joel R. Helgeson (Sep 12)
- RE: explorer.exe on port 1024 tcp Aditya (Sep 15)
- RE: explorer.exe on port 1024 tcp Elias Silva (Sep 16)
- RE: explorer.exe on port 1024 tcp Aditya (Sep 15)