Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Help - Port 80 always Opened


  • Please log in to reply

#1
testescp

testescp

    New Member

  • Member
  • Pip
  • 3 posts
Hello,


I dont know what to do more, so this is my last resource getting help from the pros.

i have windows 7 (32 bits) running comodo as firewall, disabled every service that i dont need, ICS is disabled as well.

I connect to internet using a mobile broadband connection (vodafone) WITHOUT router.

Everytime i do security test (grc and symantec) the result is alwayas the same, all ports stealth excepting port 80 that is always opened.

Tried zonealarm, comodo, windows firewall, norton. Always the same result


Using command netstat -o -n -a | findstr 0.0:80 , return 0 matches


More information:

tasklist /svc

Image Name PID Services
========================= ======== ============================================
System Idle Process 0 N/A
System 4 N/A
smss.exe 348 N/A
csrss.exe 440 N/A
csrss.exe 500 N/A
wininit.exe 508 N/A
winlogon.exe 552 N/A
services.exe 604 N/A
lsass.exe 620 SamSs
lsm.exe 628 N/A
svchost.exe 728 DcomLaunch, PlugPlay, Power
svchost.exe 820 RpcEptMapper, RpcSs
cmdagent.exe 880 cmdAgent
svchost.exe 952 CryptSvc, Dnscache, LanmanWorkstation,
NlaSvc, TapiSrv
svchost.exe 1004 Audiosrv, Dhcp, eventlog
svchost.exe 1044 AudioEndpointBuilder, hidserv, Netman,
SysMain, UxSms, WdiSystemHost, WPDBusEnum,
wudfsvc
svchost.exe 1080 AeLookupSvc, gpsvc, IKEEXT, MMCSS, ProfSvc,
RasMan, Schedule, SENS, ShellHWDetection,
Themes, Winmgmt
audiodg.exe 1156 N/A
svchost.exe 1196 EventSystem, netprofm, nsi, SstpSvc,
WdiServiceHost
AvastSvc.exe 1352 avast! Antivirus
dwm.exe 1464 N/A
explorer.exe 1484 N/A
svchost.exe 1524 BFE, DPS
taskhost.exe 1548 N/A
sppsvc.exe 1724 sppsvc
cfp.exe 1832 N/A
AvastUI.exe 1912 N/A
svchost.exe 1988 PolicyAgent
MagicDisc.exe 396 N/A
rundll32.exe 1268 N/A
WmiPrvSE.exe 2088 N/A
svchost.exe 2192 WerSvc
cmd.exe 2904 N/A
conhost.exe 2928 N/A
WUDFHost.exe 3040 N/A
tasklist.exe 3104 N/A



Ty in advance

Edited by testescp, 05 May 2012 - 09:14 AM.

  • 0

Advertisements


#2
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,025 posts
  • MVP
Get TCPView from:

http://live.sysinter...com/Tcpview.exe

Save it to your desktop then Run it (Win 7 or Vista right click and Run As Admin.)

It should tell you what is listening on 80.

Download OTL from
http://www.geekstogo...timers-list-it/
and Save it to your desktop.

Run OTL (Vista or Win 7 => right click and Run As Administrator)

select the All option in the Extra Registry group then Run Scan.

You should get two logs. Please copy and paste both of them.


Ron
  • 0

#3
testescp

testescp

    New Member

  • Topic Starter
  • Member
  • Pip
  • 3 posts
Rkinner,

First of all Ty for your reply.

By the way i went to port detective.com and used their application, the result was port 80 blocked. So my ISP is blocking my port 80. This means that i don't have to be concerned, right?


Anyway i attach the logs that you have requested.
As i said before nothing is listening on port 80, tcpview (0 matches for port 80) same results of netstat -o -n -a | findstr 0.0:80.



Ty for help.

Attached Files


  • 0

#4
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,025 posts
  • MVP
OK so it's your ISP that is "listening" on port 80?

I don't see any obvious signs of malware. If you are not seeing any signs yourself then it's probably not worth running a series of scans to make sure.
  • 0

#5
testescp

testescp

    New Member

  • Topic Starter
  • Member
  • Pip
  • 3 posts
Rkinner,


Im so unhappy with this. I really cant understand why my port 80 appears to be opened on grc and symantec scanner. No signals of virus/spyware, firewall set to stealth ports, and tcpview or netstat says nothing is listening port 80.

So i have to assume that my ISP blocking my port 80 (as portdetective scanner said), but at the same time i cant understand if its blocked by ISP why its shows on grc and symantec scanners as opened and not to sthealth or blocked.

If u can help me further, i apreciate.


Ty for ur help.
  • 0

#6
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,025 posts
  • MVP
I assume that rather than blocking port 80 your ISP is routing it to another computer to pick up attack attempts. PM me with your IP address and let me do a traceroute.

Ron
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP