• Welcome to TechPowerUp Forums, Guest! Please check out our forum guidelines for info related to our community.

Vista - Listening Ports 49152-49157

ironclaw

New Member
Joined
Feb 6, 2007
Messages
4 (0.00/day)
Can anyone tell me which service/program is opening these ports?

Ports 49152, 49153, 49154, 49155, 49156, 49157.

The PID for each of these translates to a system process.

Thanks!
 

Alec§taar

New Member
Joined
May 15, 2006
Messages
4,677 (0.71/day)
Location
Someone who's going to find NewTekie1 and teach hi
Processor DualCore AMD Athlon 64x2 4800+ (o/c 2801mhz STABLE (Ketxxx, POGE, Tatty One, ME))
Motherboard ASUS A8N-SLI Premium (PCIe x16, x4, x1)
Cooling PhaseChange Coolermaster CM754/939 (fan/heatsink), Thermalright heatspreaders + fan built on (RAM)
Memory 512mb PC-3200 DDR400 (set DDR-33 for o/c) by Corsair (matched pair, 2x256mb) 200.1/200mhz
Video Card(s) BFG GeForce 7900 GTX OC 512mb GDDR3 ram (o/c manually to 686 core/865 memory) - PhaseChange cooled
Storage Dual "Raptor X" 16mb 10krpm/RAID 0 Promise EX8350 x4 PCIe 128mb & Intel IO chip/CENATEK RocketDrive
Display(s) SONY 19" Trinitron MultiScan 400ps 1600x1200 75hz refresh 32-bit color
Case Antec Super-LanBoy (aluminum baby-tower w/ lower front & upper rear cooling exhaust fans)
Audio Device(s) RealTek AC97 onboard mobo stereo sound (Altec Lansing ACS-45 speakers - 10 yrs. still running!)
Power Supply Antec 500w ATX 2.0 "SmartPower" powersupply
Software Windows Server 2003 SP #1 fully patched, & massively tuned/tweaked to-the-max (plus latest drivers)
Can anyone tell me which service/program is opening these ports?

Ports 49152, 49153, 49154, 49155, 49156, 49157.

The PID for each of these translates to a system process.

Thanks!

Well, I don't run VISTA here yet, currently, but since much of it's the SAME as 2000/XP/Server 2003 (this latter one's it's 'base code' it was built upon & this I use)? This ought to cut the mustard

From a DOS prompt window, type this command ->

netstat -a -b -n -o

The press ENTER...

It tells you a LOT more than netstat command issued alone can do, perhaps this will "shed more light on it" for you, helping you determine what is what, here.

(Incidentally - netstat /? gets you all of its commandline switches, so you can look @ more of them & see my point here!)

:)

netstat -a -b

* That can do it as well, but I feel that first commandline is more "thorough"... I hope this helps @ least some.

APK

P.S.=> It's POSSIBLE these are "ephemeral ports" that Windows uses that are 'short lived' connections as well, OR "reserved ports" (which you CAN alter mind you)... see here for MORE about that:

http://www.microsoft.com/technet/community/columns/cableguy/cg1205.mspx

&

http://support.microsoft.com/default.aspx?scid=kb;en-us;812873

apk
 
Last edited:

ironclaw

New Member
Joined
Feb 6, 2007
Messages
4 (0.00/day)
Well, I don't run VISTA here yet, currently, but since much of it's the SAME as 2000/XP/Server 2003 (this latter one's it's 'base code' it was built upon & this I use)? This ought to cut the mustard

From a DOS prompt window, type this command ->

netstat -a -b -n -o

The press ENTER...

It tells you a LOT more than netstat command issued alone can do, perhaps this will "shed more light on it" for you, helping you determine what is what, here.

(Incidentally - netstat /? gets you all of its commandline switches, so you can look @ more of them & see my point here!)

:)

netstat -a -b

* That can do it as well, but I feel that first commandline is more "thorough"... I hope this helps @ least some.

APK

P.S.=> It's POSSIBLE these are "ephemeral ports" that Windows uses that are 'short lived' connections as well, OR "reserved ports" (which you CAN alter mind you)... see here for MORE about that:

http://www.microsoft.com/technet/community/columns/cableguy/cg1205.mspx

&

http://support.microsoft.com/default.aspx?scid=kb;en-us;812873

apk


Thank you very much! Such a wealth of useful info. ;)

When I try the -b switch it tells me that I need elevation. Is there a way to use this switch without logging in as Admin?

According to their PIDs, all six of those ports translate to either wininit.exe, svchost.exe, lsass.exe, or services.exe.

By the way, I enjoyed reading your "Securing Windows 2000/XP/Server 2003 services" post!
 
Joined
Apr 8, 2006
Messages
714 (0.11/day)
System Name Xbox 360 Super Elite
Processor 3.2GHz PowerPC Tri-Core Xenon
Memory 512MB 700MHz GDDR3 RAM
Video Card(s) ATI Xenos @ 500 MHz
Storage 250GB
Display(s) 26" Samsung LCD HDTV
Case Super Elite (COD:MW2 Edition)
Audio Device(s) 5.1
Power Supply 120w
Software NXE
after you type "cmd" instead of just hitting enter to start the dos prompt, hold down ctrl + shift then push enter, it will elevate the dos prompt to admin
 

Alec§taar

New Member
Joined
May 15, 2006
Messages
4,677 (0.71/day)
Location
Someone who's going to find NewTekie1 and teach hi
Processor DualCore AMD Athlon 64x2 4800+ (o/c 2801mhz STABLE (Ketxxx, POGE, Tatty One, ME))
Motherboard ASUS A8N-SLI Premium (PCIe x16, x4, x1)
Cooling PhaseChange Coolermaster CM754/939 (fan/heatsink), Thermalright heatspreaders + fan built on (RAM)
Memory 512mb PC-3200 DDR400 (set DDR-33 for o/c) by Corsair (matched pair, 2x256mb) 200.1/200mhz
Video Card(s) BFG GeForce 7900 GTX OC 512mb GDDR3 ram (o/c manually to 686 core/865 memory) - PhaseChange cooled
Storage Dual "Raptor X" 16mb 10krpm/RAID 0 Promise EX8350 x4 PCIe 128mb & Intel IO chip/CENATEK RocketDrive
Display(s) SONY 19" Trinitron MultiScan 400ps 1600x1200 75hz refresh 32-bit color
Case Antec Super-LanBoy (aluminum baby-tower w/ lower front & upper rear cooling exhaust fans)
Audio Device(s) RealTek AC97 onboard mobo stereo sound (Altec Lansing ACS-45 speakers - 10 yrs. still running!)
Power Supply Antec 500w ATX 2.0 "SmartPower" powersupply
Software Windows Server 2003 SP #1 fully patched, & massively tuned/tweaked to-the-max (plus latest drivers)
Sorry first of all for the lag in my reply... when I posted that, it was VERY late last night, & I had things to do today... so, again, my apologies.

Thank you very much! Such a wealth of useful info. ;)

Well, you're welcome - you would have come across it eventually, from somebody other than myself most likely.

When I try the -b switch it tells me that I need elevation. Is there a way to use this switch without logging in as Admin?

The poster before myself illustrates the "how" of doing that...

According to their PIDs, all six of those ports translate to either wininit.exe, svchost.exe, lsass.exe, or services.exe.

That's indicative of various services using the ports you noted most likely (and the netstat commandline will indicate which ones, specifically as to the ports they are using as ephemerals in client-server type work, or as reserved ports)!

All, except iirc, wininit.exe (that's something that MAY be a "trojan horse", see the url below next):

http://www.pchell.com/virus/wininit.shtml

That shows you how to remove it.

http://support.microsoft.com/kb/299332

That's one from Microsoft indicating it is also a virus/malware/trojan process as well.

By the way, I enjoyed reading your "Securing Windows 2000/XP/Server 2003 services" post!

Cool, glad you enjoyed it, & I hope you employed it + found it useful for making your system that much more secured.

APK
 
Top