From: Gregg N 

"Geo."  wrote in news:40b698f4{at}w3.nls.net:

> "Gregg N"  wrote in message
> news:40b612a1{at}w3.nls.net...
>> I tried stopping Task Scheduler from the services control panel, but
>> port 1025 remained in listening state. I can telnet into this port
>> successfully, but nothing is generated or echoed when I do.
>
> Yes and I don't know why windows does that but I've seen it before.
> For example I had the MS news server installed on a machine at one
> time, then we moved to dnews so stopped the news service and
> uninstalled it as best I could but port 119 remains open if I port
> scan the machine. As best I can tell there is nothing listening on
> that port but it still tests as open for some reason. I'm assuming
> your experience with task manager is similar.
>
> Geo.

Tcpview (and netstat) says the process listening on 1025 is the instance of
svchost with pid 656. So I did a taskview /svc to find out what services
are running inside that instance of svchost. Here is what I got:

svchost.exe 656 AudioSrv, BITS, CryptSvc, Dhcp, dmserver,
                ERSvc, EventSystem,
                FastUserSwitchingCompatibility, helpsvc,
                lanmanserver, lanmanworkstation, Netman,
                Nla, RasMan, Schedule, seclogon, SENS,
                SharedAccess, ShellHWDetection, srservice,
                TapiSrv, TermService, Themes, TrkWks,
                uploadmgr, W32Time, winmgmt, wuauserv, WZCSVC

As you can see, "schedule" is in fact one of the services running
inside this instance of svchost. But there are also two dozen others.

It seems crazy that I should have to play detective to determine what ports
are listened on by which Windows services. Isn't any of this documented?

Gregg

--- BBBS/NT v4.01 Flag-5