full-disclosure - fport results

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <a2466f8d050902064620f1ed22@mail.gmail.com>
Date: Fri Sep  2 14:46:40 2005
From: xurron at gmail.com (X u r r o n)
Subject: fport results

i got these results from fport, i found Messenger suspcious on port 13929 
and its listening if i do telnet to it.
  Pid Process Port Proto Path
1292 svchost -> 135 TCP C:\WINDOWS\system32\svchost.exe
1384 svchost -> 1025 TCP C:\WINDOWS\System32\svchost.exe
792 navapw32 -> 1027 TCP C:\PROGRA~1\NORTON~1\navapw32.exe
344 alg -> 3002 TCP C:\WINDOWS\System32\alg.exe
1384 svchost -> 3003 TCP C:\WINDOWS\System32\svchost.exe
1384 svchost -> 3004 TCP C:\WINDOWS\System32\svchost.exe
880 MsnMsgr -> 3363 TCP C:\Program Files\MSN Messenger\MsnMsg
880 MsnMsgr -> 3413 TCP C:\Program Files\MSN Messenger\MsnMsg
1588 svchost -> 5000 TCP C:\WINDOWS\System32\svchost.exe
964 msmsgs -> 13929 TCP C:\Program Files\Messenger\msmsgs.exe
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20050902/365dc991/attachment.html