Full Disclosure mailing list archives
RE: explorer.exe on port 1024 tcp
From: Elias Silva <elias2000ca () yahoo ca>
Date: Tue, 16 Sep 2003 10:08:43 -0400 (EDT)
Maybe this is what you are looking for: http://securityresponse.symantec.com/avcenter/venc/data/w32.hllw.spirit.html Aditya <aditya () mail15 com> wrote: in windows 1024 in not a restricted port any user can open up and start listining on any port... restricted port is a unix concept that ms forgot to copy... can u see some connection to explorer ? try netstat -a for this info most probebly nothing more that some useless open port that various windows programs have habit of opening up u say u have scanned ur system ... but did u update the antivirus definations ? ------ Aditya Lalit Deshmukh, _____ Chief Security Officer & System and Network Administrator, Electronic Security Division, Enterprise Security Solutions, Inc -----Original Message----- From: full-disclosure-admin () lists netsys com [mailto:full-disclosure-admin () lists netsys com]On Behalf Of Joel R. Helgeson Sent: Friday, September 12, 2003 6:13 PM To: full-disclosure () lists netsys com Subject: [Full-disclosure] explorer.exe on port 1024 tcp Can anyone tell me why I would be seeing explorer.exe on windows XP pro listening on port 1024 tcp? 1024 is a restricted port, I don't think that MS would ever use it legitamately. I'm thinking it's a trojan horse or something. In googling the problem, I discovered other users that are asking the same question with no answers. MS Site is no help. I went to the machine and telnetted to 127.0.0.1:1024 and it opened a connection where I couldn't type anything, so it IS listening. I copied explorer.exe off the machine, and scanned it with an AV pkg, no virus. I ran spyware cleanup utilities to no avial. Below is the output from fport on the machine... I have examined hundreds of other XP machines and none respond on port 1024 TCP & 123 UDP. FPort v2.0 - TCP/IP Process to Port Mapper Copyright 2000 by Foundstone, Inc. http://www.foundstone.com Pid Process Port Proto Path 432 Explorer -> 1024 TCP C:\WINDOWS\Explorer.EXE 432 Explorer -> 123 UDP C:\WINDOWS\Explorer.EXE 4 System -> 123 UDP Any insight into this would be appreciated. Joel R. Helgeson "Give a man fire, and he'll be warm for a day; set a man on fire, and he'll be warm for the rest of his life." _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html BEGIN:VCARD VERSION:2.1 N:Deshmukh;Aditya;Lalit FN:Aditya Lalit Deshmukh NICKNAME:Aditya ORG:Enterprise Security Solutions;Electronic Security TITLE:Chief Security Officer, System and Network Administrator NOTE;ENCODING=QUOTED-PRINTABLE:Contact for Enterprise Security Solutions for :-=0D=0ASecuring Servers and C= lients for Airtight Security, Penetration Testing of Internet and Intranet s= ervers, Securing existing Networks, Commissioning New Networks, Virtual Priv= ate Networks (VPN), Public Key Infrastructures (PKI), Managed Security Solut= ions for Firewalls (FW) and Intrusion Detection Systems (IDS), Bandwidth Pla= nning, Management and Utilization, Firewall testing & configuration, Venerab= ility scanning & resolution, Web Applications Testing, Source code audit for= Vulnerabilities, Computer Security Policy formulation, Tracking security Po= licy in-compliances, Digital investigations and forensics, Computer Security= Audits, Biometric security system implementations, Setting up network manag= ement system (NMS), Monitoring of Security Incidences, Proper Incidences and= Vulnerabilities reporting and resolution.=0D=0AThis is my photo in PGP Key.= ... TEL;WORK;VOICE:+91 (721) 2530 475 TEL;HOME;VOICE:+91 (721) 3153 428 TEL;CELL;VOICE:+91 (982) 2222 355 TEL;PAGER;VOICE:919822222355 () attcell net TEL;WORK;FAX:+91 (721) 2530 539 TEL;HOME;FAX:+91 (721) 2530539 ADR;WORK;ENCODING=QUOTED-PRINTABLE:;Systems Security & Administation;22, Saurabh Colony,=0D=0AV.M.V Road,;Amrav= ati, Maharashtra;;444604;India LABEL;WORK;ENCODING=QUOTED-PRINTABLE:Systems Security & Administation=0D=0A22, Saurabh Colony,=0D=0AV.M.V Road,= =0D=0AAmravati, Maharashtra 444604=0D=0AIndia ADR;HOME;ENCODING=QUOTED-PRINTABLE:;;22, Saurabh Colony,=0D=0AV.M.V Road;Amravati;Maharashtra;444604;India LABEL;HOME;ENCODING=QUOTED-PRINTABLE:22, Saurabh Colony,=0D=0AV.M.V Road=0D=0AAmravati, Maharashtra 444604=0D=0AI= ndia X-WAB-GENDER:2 URL;WORK:http://earth.prohosting.com/ess2001 ROLE:Computer Security Consultant BDAY:19791006 KEY;X509;ENCODING=BASE64: MIIFgTCCBGmgAwIBAgIRAKxYY2ACQ55LsM0S4nt/sf4wDQYJKoZIhvcNAQEFBQAwgdwxCzAJ BgNVBAYTAkdCMRcwFQYDVQQKEw5Db21vZG8gTGltaXRlZDEdMBsGA1UECxMUQ29tb2RvIFRy dXN0IE5ldHdvcmsxRjBEBgNVBAsTPVRlcm1zIGFuZCBDb25kaXRpb25zIG9mIHVzZTogaHR0 cDovL3d3dy5jb21vZG8ubmV0L3JlcG9zaXRvcnkxHzAdBgNVBAsTFihjKTIwMDIgQ29tb2Rv IExpbWl0ZWQxLDAqBgNVBAMTI0NvbW9kbyBDbGFzcyAzIFNlY3VyaXR5IFNlcnZpY2VzIENB MB4XDTAzMDcxNzAwMDAwMFoXDTA0MDcxNjIzNTk1OVowgeMxNTAzBgNVBAsTLENvbW9kbyBU cnVzdCBOZXR3b3JrIC0gUEVSU09OQSBOT1QgVkFMSURBVEVEMUYwRAYDVQQLEz1UZXJtcyBh bmQgQ29uZGl0aW9ucyBvZiB1c2U6IGh0dHA6Ly93d3cuY29tb2RvLm5ldC9yZXBvc2l0b3J5 MR8wHQYDVQQLExYoYykyMDAzIENvbW9kbyBMaW1pdGVkMRgwFgYDVQQDEw9BZGl0eWEgRGVz aG11a2gxJzAlBgkqhkiG9w0BCQEWGGFkaXR5YUBvbmxpbmUubmFpbGVkLm9yZzCBnzANBgkq hkiG9w0BAQEFAAOBjQAwgYkCgYEA2FvhmGMv9ty3z4i6TH4IiRrHHINEhiun86XQLfgmmgxp oGvop+PWl0+/rV2Zfo5Vjos0kWs1Nhujuf8/00sJoxy99ui2Nu/BoY+hUXKUQZT+/lajcA3e Mmq6VYnUdsfQrZhmA6ROJinkolS0No7IBU4KseYMBJXNgUR2FBVB7ZkCAwEAAaOCAbcwggGz MB8GA1UdIwQYMBaAFPZSIhcVEwgDWb8YlZ9ItLnp/vhmMB0GA1UdDgQWBBT/ujqsIUZ1gf0g +Cb6IWv508Ep6TAOBgNVHQ8BAf8EBAMCBaAwDAYDVR0TAQH/BAIwADAgBgNVHSUEGTAXBggr BgEFBQcDBAYLKwYBBAGyMQEDBQIwRgYDVR0gBD8wPTA7BgwrBgEEAbIxAQIBAQEwKzApBggr BgEFBQcCARYdaHR0cHM6Ly9zZWN1cmUuY29tb2RvLm5ldC9DUFMwgbAGA1UdHwSBqDCBpTA4 oDagNIYyaHR0cDovL2NybC5jb21vZG8ubmV0L0NsYXNzM1NlY3VyaXR5U2VydmljZXNfMi5j cmwwOqA4oDaGNGh0dHA6Ly9jcmwuY29tb2RvY2EuY29tL0NsYXNzM1NlY3VyaXR5U2Vydmlj ZXNfMi5jcmwwLaAroCmBJ0NsYXNzM1NlY3VyaXR5U2VydmljZXNfMkBjcmwuY29tb2RvLm5l dDARBglghkgBhvhCAQEEBAMCBSAwIwYDVR0RBBwwGoEYYWRpdHlhQG9ubGluZS5uYWlsZWQu b3JnMA0GCSqGSIb3DQEBBQUAA4IBAQBhVcUi720VWqAJbrb0a1yMkM/iiyUaOylyDB1E/fCX XKJspuSJfgCS1DHcWOO8jnGYhUUGI5YLBvIN/OJMePe845RF4RFkZ2L1ObBy+9ib/z9uBOYy 7hsTXqQegEwVu/hJ3NZvC1F+Ow4Lz0ju06cvPthEjmHQyHyIThh7Wv7abAwUftyzCgdK1fJB Ce3UeoUJU9RRK3bWtvWPqffECQv0eNGvbe10PSDvCpxERqp0ivNxZBT25c42KyQDXoUYQxMG J7YukkpKN2QTRPQqt9JpNaOSyrO3XNpsoLDsIf1qKFYufxgH/PLNQ/x93Q9GX9PUdMsYhdLY QUVunAYYCZlT EMAIL;PREF;INTERNET:aditya () online nailed org EMAIL;INTERNET:aditya () online gr8domain biz EMAIL;INTERNET:hq1eo10ly001 () sneakemail com REV:20030915T190705Z END:VCARD Elias B. Silva - MCSE, CCNA, MCP+I --------------------------------- Post your free ad now! Yahoo! Canada Personals
Current thread:
- explorer.exe on port 1024 tcp Joel R. Helgeson (Sep 12)
- RE: explorer.exe on port 1024 tcp Aditya (Sep 15)
- RE: explorer.exe on port 1024 tcp Elias Silva (Sep 16)
- RE: explorer.exe on port 1024 tcp Aditya (Sep 15)