September 20th, 2004, 07:10 PM
Mstask.exe/Svchost.exe and open ports
After investigating I have come up with no good reason Mstask.exe/svchost.exe listen on a range of ports. Usually around 1038-1051. What is it waiting for? Why does it just sit there waiting for a connection? Does anything ever to connect to it? There's no solid explanation on Microsoft's site, I may be missing it though.
Just wanted to open this up for discussion. I'm sure it's something simple.
And the boxes I've seen this on are secure and uncompromised.
September 20th, 2004, 09:11 PM
Could this be for remote computer management? ie, using the computer management snap-in (compmgmt.msc) to remotely view event logs, local users and groups, etc.
September 20th, 2004, 09:35 PM
You know what? You might be right. Let me test it and I'll let you know. I should have thought of that and tried it out.
September 21st, 2004, 02:54 AM
Is it safe to kill the process to close the listening ports?
September 21st, 2004, 04:51 AM
unless your schedueling things to happen its save to stop mstask. but dont try to stop svchost...especially on XP your computer will restart.
Bukhari:V3B48N826 “The Prophet said, ‘Isn’t the witness of a woman equal to half of that of a man?’ The women said, ‘Yes.’ He said, ‘This is because of the deficiency of a woman’s mind.’”