0

I have a base new install of windows 7, and when I went to look for something else I saw the attached netstat output.

What concerns me is that this is Windows + Truecrypt + drivers, nothing else installed.

The sequential high ranged ports belonging to several different seemingly not out of place services seemed odd.

So I torched the install, used Active@ to scrub the disk, re-downloaded the ISO from MSDN, and did a fresh reinstall, viola, they are there again.

It just seems out of place, I have seen a many netstats over the years, this one just strikes me as odd, so I started thinking rootkit? (JUst FYI, when I reloaded I named the machine "Error" so that is why the task manager reads the computer name as such.)

So I would like to know if anyone else could explain it, and therefore is may be normal, or would they be worried as well, and should I start considering I have some very strange thing occuring on my network?Screen

2
  • What services are actually in the svchosts in question? The Services tab should tell you what PID is hosting what service (assuming something isn't causing it to lie to you) Oct 28, 2013 at 15:49
  • Multiple, for instance one reports to be "Security Center, TCP/IP Netbios Helper, Windows event Log, DHCP Client, and Windows Audio" (Port 49152) the next is "Windows Update, WMI, Shell Hardware Detection, Task Scheduler, and User Profile Service" (Port 49153) Then "Services.exe" (Port 49155) does not show in the PID list of the running services at all. All signs to me raise red flags of why the sequential listening ports in the high numbers, and why sequential between processes? But where could it be coming from if I am infected?
    – Sabre
    Oct 28, 2013 at 16:00

1 Answer 1

0

In the end this ended up being the fact that I did not know (too many years buried in code, less in the guts of my OS) that the ephemeral port range had been changed from > 1024 to start at 49152 as confirmed by...

netsh int ipv4 show dynamicportrange tcp

Protocol tcp Dynamic Port Range
---------------------------------
Start Port      : 49152
Number of Ports : 16384

I confirmed all executables listening were correct versions, and the alarm was false, just a misunderstanding and not anticipating them being so high.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .