Port 80 is being used by SYSTEM (PID 4), what is that?

Question

I am trying to use port 80 for my application server, but when I perform "netstat -aon" I get

TCP 0.0.0.0:80 0.0.0.0:0 LISTENING 4

When I look up the process in task manager, it shows PID 4 is SYSTEM, thats it, not extension... nothing, just "SYSTEM". Whats going on here?

I'm afraid to end this process, what do I do?

Answer 1

Last I checked, you can't end the "system" process, and if you do, I'm guessing it's going to have catastrophic effects. I'm not going to try it on the PC I'm on right now either!

It would seem that something inside Windows itself is listening on :80 - I'm going to guess that it could be something malicious. The best way to find out is to either:

a) Open a web browser to localhost and see what comes up

b) Start Telnet and telnet to localhost 80 and run some basic HTTP GET (e.g. GET /) and see what it returns

B is the better option if you think that you might be hosting malware, as you don't really want to infect yourself again. Although maybe it won't matter.

Answer 2

It's most likely IIS 6.0 or later.

The HTTP protocol stack (HTTP.sys), which runs in kernel mode, receives client requests and routes them to the appropriate request queue. Worker processes, which run in user mode, pull the requests directly from their own kernel request queues, eliminating the process hops that occur in IIS 5.0 (and that also occur in IIS 5.0 isolation mode) when the Web server sends a request to a High-isolation, out-of-process application. Because these extra process hops are eliminated in worker process isolation mode, IIS can provide application isolation without sacrificing performance.

Answer 3

I've solved this through a stackoverflow question. Follow this link to find the solution for how to get IIS to stop listening on port 80 for a specified IP address.

Answer 4

Culprit was Web Deployment Agent Service.

Better solution than net stop http is to stop the services named "Web Deployment Agent Service".