Port 251 Use

[John Coutts]

Does anyone know what tcp port 251 is used for on XP. It is not active until
the computer is logged into, and I have shut down every service that I can
without effect.

J.A. Coutts

 

[null]

Does anyone know what tcp port 251 is used for on XP. It is not active until
the computer is logged into, and I have shut down every service that I can
without effect.

I don't see it listed here as one of the ports used by XP:
http://www.hsc.fr/ressources/breves/min_srv_res_win.en.html.en

I don't know if there's a difference though between the Pro and Home
versions in this regard. Sure it's not some added application and not
a XP service?


Art
http://www.epix.net/~artnpeg

 

[null]

Using <netstat -ano>, I recovered the ProcessID. Then using a utility called
<pslist.exe>, I traced it to one of the copies of <svchost>. Searching the
registry, I tracked it to the group <netsvcs>. Unfortunately, that particular
group has 44 services that it supplies, and that is where I run into a
roadblock. There is supposed to be a utility called <tasklist.exe> on the XP
CD, but I cannot find it there or on Microsoft's site.

I found a download of what appears to be (based on context) the
correct tasklist.exe file here. Scroll down the page to find it:

http://www.bit-quest.com/forums/index.php?showtopic=1197

But I don't have XP myself so I can't help other than that. I did d/l
and scan the file with three excellent DOS av scanners and none
alerted.

As an aside, I discovered quite by accident that Microsoft has Spyware software
installed that reports to 207.46.248.249 on port 80. All completely invisible
in the background.

I suppose that's no surprise? Any ideas on how to block it yet?

Art
http://www.epix.net/~artnpeg

 

[FromTheRafters]

I found a download of what appears to be (based on context) the
correct tasklist.exe file here. Scroll down the page to find it:

http://www.bit-quest.com/forums/index.php?showtopic=1197

But I don't have XP myself so I can't help other than that. I did d/l
and scan the file with three excellent DOS av scanners and none
alerted.


I suppose that's no surprise? Any ideas on how to block it yet?

You don't suppose that's the clock updating thingy do you?

 

[Jeffrey A. Setaro]

You don't suppose that's the clock updating thingy do you?

I doubt it... NTP (Network Time Protocol) uses UDP port 123.

--
Cheers-

Jeff Setaro
(e-mail address removed)
http://people.mags.net/jasetaro/
PGP Key IDs DH/DSS: 0x5D41429D RSA: 0x599D2A99 New RSA: 0xA19EBD34

 

[Joel Moore]

(e-mail address removed) (John Coutts) wrote in

As an aside, I discovered quite by accident that Microsoft has Spyware
software installed that reports to 207.46.248.249 on port 80. All
completely invisible in the background.

That's related to the Search Assistant. I'm not sure what's it's sending
or receiving from Microsoft so I suppose it could still qualify as
"spyware". I've got ZoneAlarm blocking it anyway. If I'm looking for .txt
files on my C: drive I really don't need help from microsoft.com.