Stop unknown AppDetectService using port 8000 on windows 10 - windows

I have an unknown AppDetectService using my port 8000 and I am not able to figure out how to close it down or kill any process that seems to be running it. Its being run by System process on PID 4(found that by netstat and searching through task manager). Trying to search for the file running it on task manager leads to ntoskrnl.exe. Also task manager shows it may slightly be using GPU. So my guess is either a system process is holding the port or more probably something is using some kind of system available servers to host a service. Hitting it on the browser shows up this page:
Netstat results:
task manager screenshot showing GPU may also be firing:
Please help me kill this abomination once and for all.

I have used Process Explorer to find out what service was using this port. Since it was impossible to find it even like this, I started to shut down service by service until port 8000 wasn't occupied any more.
In my case, port 8000 was taken over by drivers for Sound BlasterX AE-5 sound card. Process Creative.AudPosService located in C:\Program Files (x86)\Creative\Connection Service has been using this port.
Luckily, it is possible to change this port. Open Creative.AudPosService.exe.config and change line where port number is located <add baseAddress="http://localhost:8000/"/> to <add baseAddress="http://localhost:9999/"/> or anything else that don't interfere with your work. Restart windows and it should be fine.

Related

How to simulate external TCP traffic in Windows?

I don't have any code yet, so please feel free to move this to a sister site, if you think it belongs there :)
I have a Program A ( I don't have it's source code, so I can't modify it's behavior ) running on my machine which keeps listening to a particular port on the system for TCP data. It's a Peer to Peer application.
System 1 running A ====================== System 2 sunning A
The program A is supposed to run on systems where I may not be allowed to modify Firewall settings to allow incoming connections on the port the program listens to. I have an EC2 linux server running Ubuntu 16.
So I thought I can use an existing tool or create a program that would connect to the server on port X, and fetch the data from the server, and locally throw that data to the port A is listening to.
System 1 running A ========= SERVER =========== System 2 sunning A
What kind of configuration should I have on the server ? And is there any program I can use for this, or an idea of how to make one ?
I did something similar to bypass firewalls and hotspots.
Check this out https://github.com/yarrick/iodine, with a proper configuration your would be able to send\receive packets as DNS queries which is I know is always allowed, I used my server to get usual internet access with any hotspot I found.
You would lose some time, higher latency but you will have access.
Hope I helped.

How do I find out whats closing my port?

On a Windows Server 2016 Standard, 64-bit, x64-based server, I try to connect to a specific port (1807) to access a third party application using Eclipse. However, an as yet unidentified process is closing it.
How do I find out what?
There seems to be lots of info about how to close ports on SO, but can't find anything about how to monitor what is closing it.
According to a co-worker who looks after the firewall the port is open. Although I also tried running Eclipse on the server and connection to the port inside the firewall. Tried connecting via a testing tool and get "The underlying connection was closed. The connection was closed unexpectedly."
The message connecting via Eclipse is "Cannot join host http://myHost:1807 - Possible reasons could be the host is temporarily unavailable, DNS cannot resolve this name. The port is not open to the outside. The host name is mispelt. The host response has timed out. The host has multiple network cards but one of them is not responding. The newtwork infrastructure does not allow the access to this host".
Eclipse connects via another port OK.
Please let me know if you have any ideas about how to solve this.
You can get the PID of port closing program by netstat -a -n -o. Then by using
tasklist /fi "pid eq 6368" you can find the name of program. 6368 is the pid of program that's blocking the port

How check the restSecureServicesPort is available?

I've installed a application with a service on a Windows Server 2012 R2. The status of the service is paused. When I start the service, he runs for two seconds and he's again paused.
In the instructions from the manufacturer is written:
Note: If the service shows as paused, check the restSecureServicesPort is available.
What does that mean? What should I do?
This could mean, that you application hosts a REST service on this Windows service. REST (REpresentational State Transfer) is a simple stateless architecture that generally runs over HTTP. This means it needs a port on which the application listens and receive data. This port is probably already busy and another application uses it. To view all busy ports you could use the netstat command via the command line on your server. But first you have to find out on which port your application wants to listen (maybe through some documentation of the application).
After this you could check if it's possible to change the port of your application or the port of the application which occupies this port.
Hope this helps!

Windows Process from PID

I'm trying to determine which application or system program is using a particular port on a Windows 2008 R2 machine.
I've run
netstat -a -n -o
And have determined that PID is holding open port 445, which I'm interested in.
But when I run tasklist or Microsoft's pslist program, it tells me that the process holding the port open is simply named 'Sys'.
Is there another tool or approach I can use to find which is the real process holding it open?
PID 4 is the system process - if PID 4 is holding a port open, it means that some device driver has opened the port. Given that it's port 445, my guess is that it's the CIFS network filesystem or server. Try doing a "net stop srv" and "net stop rdr" from an elevated command prompt - that should shut down the service using the port.
The sysinternals tool procexp (process explorer) shows both processes and if the process is a service - it can show which services are running in the same process. (Windows service processes can contain a number of service threads).
Port 445 is normally the SMB port for Windows domain activities and file sharing and so on.
Have you looked at TCPView http://technet.microsoft.com/en-us/sysinternals/bb897437? It's another tool from sysinternals.
There is a free tool on Nirsoft's website called "CPORTS" with both 32 and 64 bit versions that might help you. Port 445 is used by Server 2008 R2 and later for communicating with other systens using SAMBA /TCP. I got the list below from "cyberciti.biz"
■netbios-ns - 137/tcp # NETBIOS Name Service
■netbios-dgm - 138/tcp # NETBIOS Datagram Service
■netbios-ssn - 139/tcp # NETBIOS session service
■microsoft-ds - 445/tcp # if you are using Active Directory
■Port 389 (TCP) - for LDAP (Active Directory Mode)
■Port 445 (TCP) - NetBIOS was moved to 445 after 2000 and beyond, (CIFS)
■Port 901 (TCP) - for SWAT service (not related to client communication
If you can run "grep" this is their recommended format: "$ grep -i NETBIOS /etc/services". If not, "AstroGrep" is a little more "user-friendly" Both can be gotten from SourceForge. My own interest lies in a solution to why some systems are unable to map network drives to a server 2008 R2 box yet they have no problem making a VPN connection and running the SQL software on the same server. Port 445 is the one I am most closely looking at due to NETBIOS needs but I really don't have a clue. One person can be unable to map a drive letter from their laptop on their home internet, but then use their cellphone as a tethered modem and map it with no problem. Same system same everything else.
I hope one of these helps you, as my problem is still ongoing but the Nirsoft tool is the easiest to use by far and the listed use of grep did give me other information that may be of use to you. The tool from Nirsoft provides an excellent map of all ports in use and plenty of other information. Requires no installation and small enough to keep handy on a flashdrive. Grep or Astrogrep from SourceForge.
Happy Holidays

How do I free my port 80 on localhost Windows?

I installed XAMPP 1.6.8 and for some reason it didn't work. Later realized port 80 is not free or not listening. How can I release it or make it free?
Thanks a lot!
I found out that what was taking over port 80 is http api service. I wrote in cmd:
net stop http
Asked me "The following services will be stopped, do you want to continue?" Pressed y
It stopped a number of services actually.
Then wrote localhost and wallah, Apache is up and running on port 80.
Important: Skype uses port 80 by default, you can change this in skype options > advanced > connection - and uncheck "use port 80"
netstat -ano
That will show you the PID of the process that is listening on port 80.
After that, open the Task Manager -> Processes tab. From the View -> Select Columns menu, enable the PID column, and you will see the name of the process listening on port 80.
I had this problem previously,
if you see the Task manager(after enabling the view for PID), you will find PID=4 is "port 80 in use by NT Kernel & System; "
Just go to
Control Panel
Programs
Turn Windows features on/off
check if the World wide web services under IIS is checked
If so, Uncheck and netstat(or TCPVIEW) again to see if 80 is free.
netstat -a -b
Should tell you what program is bound to port 80
use netstat -bano in an elevated command prompt to see what apps are listening on which ports.
But Usually following applications uses port 80 in windows.
IIS
World Wide Web Publishing service
IIS Admin Service
SQL Server Reporting services
Web Deployment Agent Service
Stop above applications if running and check!!!
Use TcpView to find the process that listens to the port and close the process.
Other option to try is to stop SQL Server Reporting Services.
You can use net stop http it will display which process is using. Moslty world wide web services are using
Try
netstat -anb -p tcp
that show ports and processes
I was trying to install nginx from here - http://nginx.org/en/docs/windows.html
Going to http://localhost/ will show something, at least a proper "not found" message
This is because 80 is the default port, and it was taken by other processes.
Now run below command:
net stop http
// Above command stopped below services
// - SSDP Discovery
// - Print Spooler
// - BranchCache
// - Function Discovery Resource Publication
// - Function Discovery Provider Host
Now, going to http://localhost/ will fail with a broken link page message.
Main process was BranchCache
This process, after stopped, will restart in a few seconds.
So we need to run other commands we need soon, an example below:
// this will stop
net stop http
// immeidately run other command you want to
start nginx
Now, going to http://localhost/ gave me:
Welcome to nginx!
Hope that helps.
Type in "netstat -ano" into your command line. I saw that it was showing something for Local Address port 0.0.0.0:80.
My issue was because I had SQL Server Reporting Services on Port 80. So I followed these instructions and changed the port # from 80 to 81:
http://seankilleen.com/2012/11/how-to-stop-sql-server-reporting-services-from-using-port-80-on-your-server-field-notes/
Here is a picture of my command line AFTER I changed the port number for SQL Server Reporting Services:
If you are still having the same issue, read this forum:
http://forum.wampserver.com/read.php?2,66196,66233#REPLY
This is just a guess, but since port 80 is the conventional port for HTTP, you may have a webserver running on your system. Is IIS active?
If you are running IIS you may have the web farm service running. That was what was killing my xampp.
Skype likes to use port 80 and blocks IIS. That was my prob.
I also had the same problem. net stop http didn't help and World wide web services option under IIS in Windows Control Panel was unchecked. So in XAMPP control panel I just checked the Svc checkbox near Apache start button (Install Apache as service) and rebooted Windows. And now each time Windows starts Apache is started automatically and occupies port 80 before any other service does. Worked for me!
Known Windows Services That Listen on Port 80
From Services Manager (run: services.msc), stop and disable these Windows Services which are known to bind to port 80.
Double click Service, and change ‘Startup Type’ to ‘Disabled’…
SQL Server Reporting Services (ReportServer)
Web Deployment Agent Service (MsDepSvc)
BranchCache (PeerDistSvc)
Sync Share Service (SyncShareSvc)
World Wide Web Publishing Service (W3SVC)
Internet Information Server (WAS, IISADMIN)
skype also using port 80 as default setting and you can uncheck it.
You might, or might not, have some of these Services installed and running.
In my case "SQL Server Reporting Services" was opening port 80.
Identify the real process programmatically
(when the process ID is shown as 4)
The answers here, as usual, expect a level of interactivity.
The problem is when something is listening through HTTP.sys; then, the PID is always 4 and, as most people find, you need some tool to find the real owner.
Here's how to identify the offending process programmatically. No TcpView, etc (as good as those tools are). Does rely on netsh; but then, the problem is usually related to HTTP.sys.
$Uri = "http://127.0.0.1:8989" # for example
# Shows processes that have registered URLs with HTTP.sys
$QueueText = netsh http show servicestate view=requestq verbose=yes | Out-String
# Break into text chunks; discard the header
$Queues = $QueueText -split '(?<=\n)(?=Request queue name)' | Select-Object -Skip 1
# Find the chunk for the request queue listening on your URI
$Queue = #($Queues) -match [regex]::Escape($Uri -replace '/$')
if ($Queue.Count -eq 1)
{
# Will be null if could not pick out exactly one PID
$ProcessId = [string]$Queue -replace '(?s).*Process IDs:\s+' -replace '(?s)\s.*' -as [int]
if ($ProcessId)
{
Write-Verbose "Identified process $ProcessId as the HTTP listener. Killing..."
Stop-Process -Id $ProcessId -Confirm
}
}
Originally posted here: https://stackoverflow.com/a/65852847/6274530
I faced the same issue and fixed it by making a small change in the httpd.conf file which can be obtained by clicking the config button along with the Apache option.
The change I made was to replace listen 80 with listen 8080.
For me, this problem began when I hosted a VPN-connection on my Windows 8 computer.
Simply deleting the connection from "Control Panel\Network and Internet\Network Connections" solved the problem.

Resources