Printable View
I just found two files on my Windows 2000 server that are holding a port open. I searched Microsoft, Google newsgroups and others to find information but no one seems to know what these files are for.
The file names are:
bmss.exe
bmssldr.exe
Note: When I checked the version information for bmss.exe it said "BMonitor Session Manager" by Microsoft.
I was wondering if anyone here knows what they are for?
Thanks in advance,
Js
Which ports are held open?
How are they being started, as a service or what. Can you stop them from starting and see if the server continues to function as normal?
If you can find no reference on the sites you searched I would be a little leary. Google will usually pop up with something about anything you search for..... As does the M$ kb.... I looked in both and there was nothing..... IMO, a cause for some concern.
You may also want to put a packet-sniffer on the open ports on that machine for a few days and see if it generates or receives any traffic.
I just did a google search for bmss.exe
It came back to me as a 'one hit wonder'
bmss.exe
Sorry getting of topic.
I do not have an answer but found it worth posting though.
Go to www.sysinternals.com and get:
TCPView
Process Explorer
or go to www.foundstone.com and get:
fport
These tools should give you a much better idea about what these files are doing.
Hope this helps!
http://new.inetc.net/Products/Dedica...eck/sample.htm
Looks like a health monitor. The link i posted shows a sample of what information it provides (bmss.exe). Im not sure yet why it opens up a port though. It would really help to find out what ports its listening on. We have a win 2000 server, and its not on there :|
Noodle: That's bloody wierd - I just searched Google for bmss.exe, bmssldr.exe and BMonitor Session Manager..... It came up with nothing for any of them
Instronics
The link mentioned is a sample of a company selling dedicated servers.
You can buy the product but the link shows an example of the health check.
bmss.exe shows up as a process in the check.
It does not show what the process does.
Tigershark - follow the link I provided. :D
The bmss.exe has the following ports open:
bmss.exe:232 TCP 0.0.0.0:8198 0.0.0.0:0 LISTENING
bmss.exe:232 UDP ???.???.???.???:8196 *:*
Note: I replaced the IP address with the ???
Could it be like Patrol SNMP?
they got stuff like that on XP, on know on there they are services for uniquly identifying web sites.if thats the case on your server id be sure to untick those if you mange to find it.