Архив форумов ЦИТФорума

[kvardask12]

Итак кто-то занял порт. этот кто-то 100% подарок от MS. т.е. не троян и т.п., хотя возможно и такое...
Больше всего конечно интересует то, как освободить порт, т.к. он жизненно необходим.
Win2k srv
netstat -an
UDP 192.168.0.1:67 *:*
tcpview
svchost.exe:600 UDP comp:bootps *:*
tlist -s
600 svchost.exe Svcs: EventSystem,Netman,NtmsSvc,RasMan,SENS,SharedAccess
tlist 600
600 svchost.exe
CWD: D:\WINNT\system32\
CmdLine: D:\WINNT\System32\svchost.exe -k netsvcs
VirtualSize: 34756 KB PeakVirtualSize: 38916 KB
WorkingSetSize: 6580 KB PeakWorkingSetSize: 6636 KB
NumberOfThreads: 29
596 Win32StartAddr:0x010010b8 LastErr:0x000003e5 State:Waiting
604 Win32StartAddr:0x77dc9563 LastErr:0x000003e5 State:Waiting
624 Win32StartAddr:0x00000575 LastErr:0x00000000 State:Waiting
628 Win32StartAddr:0x77ab464e LastErr:0x00000000 State:Waiting
652 Win32StartAddr:0x77dc9563 LastErr:0x00000000 State:Waiting
780 Win32StartAddr:0x77dc9563 LastErr:0x00000002 State:Waiting
800 Win32StartAddr:0x77f89d5d LastErr:0x00000000 State:Waiting
824 Win32StartAddr:0x00000580 LastErr:0x00000000 State:Waiting
832 Win32StartAddr:0x762916aa LastErr:0x00000000 State:Waiting
836 Win32StartAddr:0x76291a3b LastErr:0x00000000 State:Waiting
840 Win32StartAddr:0x00000000 LastErr:0x000003f0 State:Waiting
948 Win32StartAddr:0x77dc9563 LastErr:0x000003e5 State:Waiting
980 Win32StartAddr:0x778321fe LastErr:0x00000000 State:Waiting
804 Win32StartAddr:0x75675fa4 LastErr:0x00000000 State:Waiting
1020 Win32StartAddr:0x775323a7 LastErr:0x00000000 State:Waiting
1024 Win32StartAddr:0x77d41c55 LastErr:0x0000006d State:Waiting
1028 Win32StartAddr:0x00000000 LastErr:0x00000000 State:Waiting
1032 Win32StartAddr:0x77f96989 LastErr:0x00000000 State:Waiting
1036 Win32StartAddr:0x77f96989 LastErr:0x000003e5 State:Waiting
1040 Win32StartAddr:0x7591876c LastErr:0x00000000 State:Waiting
1048 Win32StartAddr:0x77f9671d LastErr:0x00000000 State:Waiting
1052 Win32StartAddr:0x77f89fa2 LastErr:0x00000000 State:Waiting
1360 Win32StartAddr:0x761d207c LastErr:0x00000000 State:Waiting
1372 Win32StartAddr:0x761d9976 LastErr:0x00000000 State:Waiting
240 Win32StartAddr:0x77dc9563 LastErr:0x000003e5 State:Waiting
1396 Win32StartAddr:0x0000057c LastErr:0x00000000 State:Waiting
1400 Win32StartAddr:0x00000000 LastErr:0x000003f0 State:Waiting
1404 Win32StartAddr:0x00000000 LastErr:0x000003f0 State:Waiting
1408 Win32StartAddr:0x0000057e LastErr:0x00000000 State:Waiting
5.0.2134.1 shp 0x01000000 svchost.exe
5.0.2195.2779 shp 0x77f80000 ntdll.dll
5.0.2195.2867 shp 0x77db0000 ADVAPI32.DLL
5.0.2195.2778 shp 0x77e80000 KERNEL32.DLL
5.0.2195.6753 shp 0x77d30000 RPCRT4.DLL
5.0.2195.6769 shp 0x77a50000 OLE32.DLL
5.0.2195.2778 shp 0x77f4000 ...

[kvardask12]

продолжение
5.0.2195.6769 shp 0x77a50000 OLE32.DLL
5.0.2195.2778 shp 0x77f40000 GDI32.dll
5.0.2195.2821 shp 0x77e10000 USER32.DLL
2000.2.3471.1 shp 0x76290000 es.dll
2000.2.3471.1 shp 0x00440000 TXFAUX.DLL
6.1.8924.0 shp 0x78000000 MSVCRT.dll
2.40.4517.0 shp 0x779b0000 OLEAUT32.DLL
2000.2.3471.1 shp 0x775a0000 CLBCATQ.DLL
5.0.2195.2779 shp 0x761d0000 ntmssvc.dll
5.0.2163.1 shp 0x76180000 sens.dll
5.81.3103.1000 shp 0x77b50000 COMCTL32.dll
5.0.2195.2780 shp 0x75030000 WS2_32.dll
5.0.2134.1 shp 0x75020000 WS2HELP.DLL
5.0.2195.2728 shp 0x75710000 rasmans.dll
5.0.2168.1 shp 0x77830000 rtutils.dll
5.131.2195.2833 sh 0x77440000 CRYPT32.dll
5.0.2134.1 shp 0x77430000 MSASN1.DLL
5.0.2195.2228 shp 0x6a4b0000 netcfgx.dll
5.0.2195.2785 shp 0x77980000 DNSAPI.dll
5.0.2195.2871 shp 0x75050000 WSOCK32.DLL
5.0.2195.2671 shp 0x774e0000 RASAPI32.dll
5.0.2195.2780 shp 0x774c0000 RASMAN.DLL
5.0.2182.1 shp 0x77530000 TAPI32.DLL
5.0.3315.1000 shp 0x77c70000 SHLWAPI.DLL
5.0.2195.2671 shp 0x75870000 RASDLG.dll
5.0.2181.1 shp 0x77320000 MPRAPI.dll
5.0.2195.2780 shp 0x75150000 SAMLIB.DLL
5.0.2195.2808 shp 0x75170000 NETAPI32.DLL
5.0.2195.2862 shp 0x77be0000 SECUR32.DLL
5.0.2134.1 shp 0x751c0000 NETRAP.DLL
5.0.2195.2797 shp 0x77950000 WLDAP32.DLL
5.0.2195.2778 shp 0x773b0000 ACTIVEDS.DLL
5.0.2195.2842 shp 0x77380000 ADSLDPC.DLL
5.0.2195.2663 shp 0x77880000 SETUPAPI.DLL
5.0.2195.2780 shp 0x77c10000 USERENV.DLL
5.0.2195.2671 shp 0x75670000 rastapi.dll
5.0.2195.2671 shp 0x75900000 rasppp.dll
5.0.2134.1 shp 0x756e0000 ntlsapi.dll
5.0.2195.2671 shp 0x68c30000 raschap.dll
5.0.2195.2671 shp 0x68b10000 rastls.dll
3.0.8449.0 shp 0x773e0000 ATL.DLL
5.1.2195.0 shp 0x78160000 SCHANNEL.dll
5.0.2134.1 shp 0x76960000 WinSCard.dll
5.0.2195.2778 shp 0x77360000 dhcpcsvc.dll
5.0.2134.1 shp 0x77520000 ICMP.DLL
5.0.2173.2 shp 0x77340000 IPHLPAPI.DLL
5.0.2195.2667 shp 0x776c0000 ipnathlp.dll
5.0.2195.2871 shp 0x74ff0000 MSWSOCK.dll
5.0.3315.2902 shp 0x782f0000 SHELL32.dll
5.0.2195.2779 shp 0x74fd0000 msafd.dll
5.0.2195.2104 shp 0x75010000 wshtcpip.dll
5.0.2195.2779 shp 0x76240000 NTMSDBA.dll
5.0.2195.2779 shp 0x76270000 netman.dll
5.0.2195.2779 shp 0x76f20000 NETSHELL.dll
5.0.2191.1 shp 0x76110000 WMI.dll

[4u3u]

[...]
tlist -s
600 svchost.exe Svcs: EventSystem,Netman,NtmsSvc,RasMan,SENS,SharedAccess
[...]
5.0.2195.2778 shp 0x77360000 dhcpcsvc.dll
[...]

SharedAcces - это ICS (Internet Connection Sharing). Он, кроме всего прочего, использует DHCP для конфигурирования клиентских компьютеров. А DHCP использует 67-й порт.