Re: Open Connections viewed via Netstat -ano

From: Bill Sanderson (Bill_Sanderson@msn.com.plugh.org)
Date: 11/05/02 

From: "Bill Sanderson" <Bill_Sanderson@msn.com.plugh.org>
Date: Tue, 5 Nov 2002 11:47:52 -0500

I looked again for a reference in the KB but didn't find it.

I suspect that what is using the port will be a process running under one of
the SVCHOST instances.

"Sarath33" <noemail@noemail.com> wrote in message
news:6d2601c284e8$08754f20$36ef2ecf@tkmsftngxa12...
>
> Thanks, I can see the possibility there but why oh why
> would XP hold a constant open port and establish a
> connection like this? I've gone step by step through all
> my running processess/services and modified a number of
> them to Manual start vs Automatic and even disabled some
> that I felt were not necessary. But..those two open
> connections still stand. I've set ZA to it's highest
> security and locked down the connection and then removed
> all MS items that I've allowed access. When I opened the
> connection back up and then waited to see what services
> would request access, nothing related to the Search
> Assistant requested outside access. Very puzzling.
>
>
> >-----Original Message-----
> >I think sa is the Search Assistant. I believe this is
> innocuous, but I
> >can't cite a reference at the moment--i.e. I think
> Microsoft views it as
> >doing something useful for you, and not sending any
> personally identifiable
> >data, etc, etc..
> >
> >
> >"sarath33" <noemail@noemail.com> wrote in message
> >news:be3d01c28491$c67a8dc0$35ef2ecf@TKMSFTNGXA11...
> >> I run the latest Adaware and Spybot both of which say
> that
> >> my system is clean, also running ZA and mynetwatchman
> both
> >> of which have not reported any activity as of late
> (other
> >> than the day to day background stuff). When i did a
> >> lookup on one of the IP's it was listed as
> sa.windows.com
> >> and attempting a connection to that I was met with an
> >> Unauthorized message.
> >>
> >>
> >> >-----Original Message-----
> >> >what does the tasklist command say about PID 1092? It
> >> could be some kind
> >> >of malware to keep a connection open to a web server.
> >> >
> >> >--
> >> >Kent W. England, MS MVP for Windows XP
> >> >(Please respond only in the newsgroup)
> >> >
> >> >
> >> >"Sarath33" <notposting.personal@email.address.com>
> wrote
> >> in
> >> >message news:37e801c28484$76bea3f0
> >> $39ef2ecf@TKMSFTNGXA08...
> >> >
> >> >> I notice that there are two windows connections that
> are
> >> >> constantly open in Windows XP Home Edition. Anyone
> know
> >> >> if these are part of the Windows Update or what part
> of
> >> XP
> >> >> is holding open these ports open?
> >> >>
> >> >> 192.168.0.2:1239 207.46.226.40:80 Established
> 1092
> >> >> 192.168.0.2:1240 207.46.226.40:80 Established
> 1092
> >> >>
> >> >> Thanks
> >> >
> >> >.
> >> >
> >
> >
> >.
> >

Relevant Pages

  • DECwindows security: access to port 6000
    ... A BG6309 device was created and owned by DECW$SERVER_0 process running under ... Doesn't the server get started before I ... If this korean hacker was connected to port 6000, it is correct to state that ... connection eventually if the "client" doesn't initiate abny X protocol ...
    (comp.os.vms)
  • Re: Correction
    ... Normally to physically disconnect is just a matter of reaching for the ... >> I have an ADSL connection which polls my computer from time to time, ... > disallow each and every port with Windows Firewall? ...
    (microsoft.public.windowsxp.messenger)
  • Re: Using Remote Desktop From an SBS Domain
    ... when you tried to RDP while attached directly to a port on your router? ... Internet to initiate an IP conversation with your computer. ... This situation is different than if you ran your own NAT connection sharing ...
    (microsoft.public.windows.server.sbs)
  • Re: Still cant connect to RWW or OWA remotely
    ... it certainly appears to be something about the SBS configuration. ... Meridian.local Ethernet adapter Local Area Connection: ... Windows SMALL BUSINESS SERVER 2003 Windows IP Configuration ... 192.168.254.254) directly to a port on the router and then ...
    (microsoft.public.windows.server.sbs)
  • Re: Still cant connect to RWW or OWA remotely
    ... it certainly appears to be something about the SBS configuration. ... Meridian.local Ethernet adapter Local Area Connection: ... Windows SMALL BUSINESS SERVER 2003 Windows IP Configuration ... 192.168.254.254) directly to a port on the router and then ...
    (microsoft.public.windows.server.sbs)
Quantcast