The Computer Oracle

How to find out what is running on localhost port

-------------------------------------------------------------------------------
Become or hire the top 3% of the developers on Toptal https://topt.al/25cXVn
-------------------------------------------------------------------------------

Music by Eric Matyas
https://www.soundimage.org
Track title: Riding Sky Waves v001

--

Chapters
00:00 Question
00:27 Accepted answer (Score 64)
00:50 Answer 2 (Score 4)
01:44 Answer 3 (Score 0)
02:15 Thank you

--

Full question
https://superuser.com/questions/713794/h...

--

Content licensed under CC BY-SA
https://meta.stackexchange.com/help/lice...

--

Tags
#windows #port #localhost #windows8 #diagnostic

#avk47



ACCEPTED ANSWER

Score 68


Run netstat -a -o | find "9090" and have a look at the far right column. That's the Process ID (PID) of the owning process. Match it up with running processes in Task Manager.




ANSWER 2

Score 7


@Evan Anderson answer did not work for me cause I got a message

FIND: Parameter format not correct

so I replaced the Find call with a powershell Select-String

netstat -aon|sls 61456

  TCP    127.0.0.1:61456        0.0.0.0:0              LISTENING       31796

finally I open Task manager and looked sort the PID column looking for 31796

enter image description here

Update

Usually I want to kill these processes so here a powershell script that does not need manual intervention

netstat -aon|sls 5000|%{("$_".substring("$_".LastIndexOf(' '))).Trim()}|%{
    $id=$_
    Get-Process|?{$_.id -eq $id}
}|Stop-Process



ANSWER 3

Score 0


Did you ever install Zeus admin server or Zyxel VoIP or CiscoSecure on that machine? Other possibilities include a Trojan such as Aphex's Remote Packet Sniffer or the IANA WebSM designation.

Take a look here or search the web for port 9090 or any other for that matter.

You can always do a basic intrusion testing using the GRC ShieldsUp! service.