full-disclosure - explorer.exe on port 1024 tcp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20030916140843.56265.qmail@web10804.mail.yahoo.com>
From: elias2000ca at yahoo.ca (Elias Silva)
Subject: explorer.exe on port 1024 tcp

Maybe this is what you are looking for:
 
http://securityresponse.symantec.com/avcenter/venc/data/w32.hllw.spirit.html

Aditya <aditya@...l15.com> wrote:

in windows 1024 in not a restricted port any user can open up and start listining on any port...
restricted port is a unix concept that ms forgot to copy...

can u see some connection to explorer ? try netstat -a for this info 

most probebly nothing more that some useless open port that various windows programs have habit of opening up 

u say u have scanned ur system ... but did u update the antivirus definations ?


------ 

Aditya Lalit Deshmukh,

_____ 

Chief Security Officer &
System and Network Administrator,
Electronic Security Division,
Enterprise Security Solutions, Inc 


-----Original Message-----
From: full-disclosure-admin@...ts.netsys.com
[mailto:full-disclosure-admin@...ts.netsys.com]On Behalf Of Joel R.
Helgeson
Sent: Friday, September 12, 2003 6:13 PM
To: full-disclosure@...ts.netsys.com
Subject: [Full-Disclosure] explorer.exe on port 1024 tcp


Can anyone tell me why I would be seeing explorer.exe on windows XP pro
listening on port 1024 tcp?

1024 is a restricted port, I don't think that MS would ever use it
legitamately. I'm thinking it's a trojan horse or something. In googling the
problem, I discovered other users that are asking the same question with no
answers. MS Site is no help.

I went to the machine and telnetted to 127.0.0.1:1024 and it opened a
connection where I couldn't type anything, so it IS listening. I copied
explorer.exe off the machine, and scanned it with an AV pkg, no virus. I
ran spyware cleanup utilities to no avial.

Below is the output from fport on the machine... I have examined hundreds of
other XP machines and none respond on port 1024 TCP & 123 UDP.

FPort v2.0 - TCP/IP Process to Port Mapper
Copyright 2000 by Foundstone, Inc.
http://www.foundstone.com

Pid Process Port Proto Path
432 Explorer -> 1024 TCP C:\WINDOWS\Explorer.EXE
432 Explorer -> 123 UDP C:\WINDOWS\Explorer.EXE
4 System -> 123 UDP

Any insight into this would be appreciated.

Joel R. Helgeson

"Give a man fire, and he'll be warm for a day; set a man on fire, and he'll
be warm for the rest of his life."

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
BEGIN:VCARD
VERSION:2.1
N:Deshmukh;Aditya;Lalit
FN:Aditya Lalit Deshmukh
NICKNAME:Aditya
ORG:Enterprise Security Solutions;Electronic Security
TITLE:Chief Security Officer, System and Network Administrator
NOTE;ENCODING=QUOTED-PRINTABLE:Contact for Enterprise Security Solutions for :-=0D=0ASecuring Servers and C=
lients for Airtight Security, Penetration Testing of Internet and Intranet s=
ervers, Securing existing Networks, Commissioning New Networks, Virtual Priv=
ate Networks (VPN), Public Key Infrastructures (PKI), Managed Security Solut=
ions for Firewalls (FW) and Intrusion Detection Systems (IDS), Bandwidth Pla=
nning, Management and Utilization, Firewall testing & configuration, Venerab=
ility scanning & resolution, Web Applications Testing, Source code audit for=
Vulnerabilities, Computer Security Policy formulation, Tracking security Po=
licy in-compliances, Digital investigations and forensics, Computer Security=
Audits, Biometric security system implementations, Setting up network manag=
ement system (NMS), Monitoring of Security Incidences, Proper Incidences and=
Vulnerabilities reporting and resolution.=0D=0AThis is my photo in PGP Key.=
... 
TEL;WORK;VOICE:+91 (721) 2530 475
TEL;HOME;VOICE:+91 (721) 3153 428
TEL;CELL;VOICE:+91 (982) 2222 355
TEL;PAGER;VOICE:919822222355@...cell.net
TEL;WORK;FAX:+91 (721) 2530 539
TEL;HOME;FAX:+91 (721) 2530539
ADR;WORK;ENCODING=QUOTED-PRINTABLE:;Systems Security & Administation;22, Saurabh Colony,=0D=0AV.M.V Road,;Amrav=
ati, Maharashtra;;444604;India
LABEL;WORK;ENCODING=QUOTED-PRINTABLE:Systems Security & Administation=0D=0A22, Saurabh Colony,=0D=0AV.M.V Road,=
=0D=0AAmravati, Maharashtra 444604=0D=0AIndia
ADR;HOME;ENCODING=QUOTED-PRINTABLE:;;22, Saurabh Colony,=0D=0AV.M.V Road;Amravati;Maharashtra;444604;India
LABEL;HOME;ENCODING=QUOTED-PRINTABLE:22, Saurabh Colony,=0D=0AV.M.V Road=0D=0AAmravati, Maharashtra 444604=0D=0AI=
ndia
X-WAB-GENDER:2
URL;WORK:http://earth.prohosting.com/ess2001
ROLE:Computer Security Consultant
BDAY:19791006
KEY;X509;ENCODING=BASE64:
MIIFgTCCBGmgAwIBAgIRAKxYY2ACQ55LsM0S4nt/sf4wDQYJKoZIhvcNAQEFBQAwgdwxCzAJ
BgNVBAYTAkdCMRcwFQYDVQQKEw5Db21vZG8gTGltaXRlZDEdMBsGA1UECxMUQ29tb2RvIFRy
dXN0IE5ldHdvcmsxRjBEBgNVBAsTPVRlcm1zIGFuZCBDb25kaXRpb25zIG9mIHVzZTogaHR0
cDovL3d3dy5jb21vZG8ubmV0L3JlcG9zaXRvcnkxHzAdBgNVBAsTFihjKTIwMDIgQ29tb2Rv
IExpbWl0ZWQxLDAqBgNVBAMTI0NvbW9kbyBDbGFzcyAzIFNlY3VyaXR5IFNlcnZpY2VzIENB
MB4XDTAzMDcxNzAwMDAwMFoXDTA0MDcxNjIzNTk1OVowgeMxNTAzBgNVBAsTLENvbW9kbyBU
cnVzdCBOZXR3b3JrIC0gUEVSU09OQSBOT1QgVkFMSURBVEVEMUYwRAYDVQQLEz1UZXJtcyBh
bmQgQ29uZGl0aW9ucyBvZiB1c2U6IGh0dHA6Ly93d3cuY29tb2RvLm5ldC9yZXBvc2l0b3J5
MR8wHQYDVQQLExYoYykyMDAzIENvbW9kbyBMaW1pdGVkMRgwFgYDVQQDEw9BZGl0eWEgRGVz
aG11a2gxJzAlBgkqhkiG9w0BCQEWGGFkaXR5YUBvbmxpbmUubmFpbGVkLm9yZzCBnzANBgkq
hkiG9w0BAQEFAAOBjQAwgYkCgYEA2FvhmGMv9ty3z4i6TH4IiRrHHINEhiun86XQLfgmmgxp
oGvop+PWl0+/rV2Zfo5Vjos0kWs1Nhujuf8/00sJoxy99ui2Nu/BoY+hUXKUQZT+/lajcA3e
Mmq6VYnUdsfQrZhmA6ROJinkolS0No7IBU4KseYMBJXNgUR2FBVB7ZkCAwEAAaOCAbcwggGz
MB8GA1UdIwQYMBaAFPZSIhcVEwgDWb8YlZ9ItLnp/vhmMB0GA1UdDgQWBBT/ujqsIUZ1gf0g
+Cb6IWv508Ep6TAOBgNVHQ8BAf8EBAMCBaAwDAYDVR0TAQH/BAIwADAgBgNVHSUEGTAXBggr
BgEFBQcDBAYLKwYBBAGyMQEDBQIwRgYDVR0gBD8wPTA7BgwrBgEEAbIxAQIBAQEwKzApBggr
BgEFBQcCARYdaHR0cHM6Ly9zZWN1cmUuY29tb2RvLm5ldC9DUFMwgbAGA1UdHwSBqDCBpTA4
oDagNIYyaHR0cDovL2NybC5jb21vZG8ubmV0L0NsYXNzM1NlY3VyaXR5U2VydmljZXNfMi5j
cmwwOqA4oDaGNGh0dHA6Ly9jcmwuY29tb2RvY2EuY29tL0NsYXNzM1NlY3VyaXR5U2Vydmlj
ZXNfMi5jcmwwLaAroCmBJ0NsYXNzM1NlY3VyaXR5U2VydmljZXNfMkBjcmwuY29tb2RvLm5l
dDARBglghkgBhvhCAQEEBAMCBSAwIwYDVR0RBBwwGoEYYWRpdHlhQG9ubGluZS5uYWlsZWQu
b3JnMA0GCSqGSIb3DQEBBQUAA4IBAQBhVcUi720VWqAJbrb0a1yMkM/iiyUaOylyDB1E/fCX
XKJspuSJfgCS1DHcWOO8jnGYhUUGI5YLBvIN/OJMePe845RF4RFkZ2L1ObBy+9ib/z9uBOYy
7hsTXqQegEwVu/hJ3NZvC1F+Ow4Lz0ju06cvPthEjmHQyHyIThh7Wv7abAwUftyzCgdK1fJB
Ce3UeoUJU9RRK3bWtvWPqffECQv0eNGvbe10PSDvCpxERqp0ivNxZBT25c42KyQDXoUYQxMG
J7YukkpKN2QTRPQqt9JpNaOSyrO3XNpsoLDsIf1qKFYufxgH/PLNQ/x93Q9GX9PUdMsYhdLY
QUVunAYYCZlT


EMAIL;PREF;INTERNET:aditya@...ine.nailed.org
EMAIL;INTERNET:aditya@...ine.gr8domain.biz
EMAIL;INTERNET:hq1eo10ly001@...akemail.com
REV:20030915T190705Z
END:VCARD


Elias B. Silva - MCSE, CCNA, MCP+I


---------------------------------
Post your free ad now! Yahoo! Canada Personals
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20030916/d0140c01/attachment.html