W2K netstat detects port 1433 is listenning but fport does NOT..., can't start mission critical sql server !!!

W2K netstat detects port 1433 is listenning but fport does NOT..., can't start mission critical sql server !!!

Secure Home | Search | About
 Microsoft Antivirus Discussions    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
W2K netstat detects port 1433 is listenning but fport does NOT..., can't start mission critical sql server !!! SammyBar 10-14-2005
Posted by Roger Abell [MVP] on October 15, 2005, 2:12 am
If you were  Registered and logged in, you could reply and use other advanced thread options
But - are you saying issues with 051 specific to SQL Server ?
I have systems with SQL 2K without issues after 051.

--
Roger Abell
Microsoft MVP (Windows Server : Security)
MCDBA, MCSE W2k3+W2k+Nt4
Did you install the MS05-051 Security Update over your network. There is
many more issues cropping up aside from what is listed.

http://support.microsoft.com/?kbid=909444

--
Peter

Please Reply to Newsgroup for the benefit of others
Requests for assistance by email can not and will not be acknowledged.

>I was able to find the process that is listening on 1433 port: It is the
> System process! I can not shutdown it.
> Anyway thanks for the help
>
> Sammy
>
>



Posted by Peter Foldes on October 15, 2005, 11:01 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Roger

I did say that this Security Update made some issues to some posters =
aside from the ones listed in the KB. I have seen 1 posting concerning =
SQL where the OP said that SQL was freezing on him. He was getting the =
Event ID 778.

When he applied the workaround as described in the KB he solved his =
issue.

Not everyone is getting the issues as described in the KB but some are =
and some are getting ones that are not documented in there.

I was just trying to point to the issue as another possible fix.

--=20
Peter

Please Reply to Newsgroup for the benefit of others
Requests for assistance by email can not and will not be acknowledged.

> But - are you saying issues with 051 specific to SQL Server ?
> I have systems with SQL 2K without issues after 051.
>=20
> --=20
> Roger Abell
> Microsoft MVP (Windows Server : Security)
> MCDBA, MCSE W2k3+W2k+Nt4
> Did you install the MS05-051 Security Update over your network. There =
is=20
> many more issues cropping up aside from what is listed.
>=20
> http://support.microsoft.com/?kbid=3D909444
>=20
> --=20
> Peter
>=20
> Please Reply to Newsgroup for the benefit of others
> Requests for assistance by email can not and will not be acknowledged.
>=20
>>I was able to find the process that is listening on 1433 port: It is =
the
>> System process! I can not shutdown it.
>> Anyway thanks for the help
>>
>> Sammy
>>
>>=20
>=20
>

Posted by Roger Abell [MVP] on October 16, 2005, 12:56 am
If you were  Registered and logged in, you could reply and use other advanced thread options
Interesting Peter. Thank you for replying with the info.
Please understand, I was not meaning to seem critical,
I was honestly wondering if there had been observed
effect on SQL installs.
Thx,
Roger

Roger

I did say that this Security Update made some issues to some posters aside
from the ones listed in the KB. I have seen 1 posting concerning SQL where
the OP said that SQL was freezing on him. He was getting the Event ID 778.

When he applied the workaround as described in the KB he solved his issue.

Not everyone is getting the issues as described in the KB but some are and
some are getting ones that are not documented in there.

I was just trying to point to the issue as another possible fix.

--
Peter

Please Reply to Newsgroup for the benefit of others
Requests for assistance by email can not and will not be acknowledged.

> But - are you saying issues with 051 specific to SQL Server ?
> I have systems with SQL 2K without issues after 051.
>
> --
> Roger Abell
> Microsoft MVP (Windows Server : Security)
> MCDBA, MCSE W2k3+W2k+Nt4
> Did you install the MS05-051 Security Update over your network. There is
> many more issues cropping up aside from what is listed.
>
> http://support.microsoft.com/?kbid=909444
>
> --
> Peter
>
> Please Reply to Newsgroup for the benefit of others
> Requests for assistance by email can not and will not be acknowledged.
>
>>I was able to find the process that is listening on 1433 port: It is the
>> System process! I can not shutdown it.
>> Anyway thanks for the help
>>
>> Sammy
>>
>>
>
>



Posted by Roger Abell [MVP] on October 15, 2005, 2:19 am
If you were  Registered and logged in, you could reply and use other advanced thread options
I am hearing you make the assumption that it is a light-weight malware,
which may/may not be so. That it shows as running in a System context
only means it is using that account and/or has attached into some process
tree started by System.

Feel good that it is showing at all as that tends to say it is not rootkit
you
are up against (yet).

You might want to try PortRptr to see if the logs help you narrow things
down
http://search.microsoft.com/search/results.aspx?st=b&na=88&View=en-us&qu=PortRptr

--
Roger Abell
Microsoft MVP (Windows Server : Security)
MCDBA, MCSE W2k3+W2k+Nt4
>I was able to find the process that is listening on 1433 port: It is the
>System process! I can not shutdown it.
> Anyway thanks for the help
>
> Sammy
>



Posted by cquirke (MVP Windows shell/use on October 15, 2005, 5:45 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
On Fri, 14 Oct 2005 17:59:28 -0500, "Steven L Umbach"

>Try Process Explorer from SysInternals.

You can also try free tools from www.nirsoft.net - they have several,
including Current Process (process killer) and one for ports:

http://www.nirsoft.net/utils/cports.html

The latter lets you see what process is attached to what port, and you
can close ports and kill tasks.

Another useful set of free tools are Faber Toys.


>--------------- ----- ---- --- -- - - -
Error Messages Are Your Friends
>--------------- ----- ---- --- -- - - -

Similar ThreadsPosted
Re: Please help me interpret a suspicious netstat SYN_SENT TCP port 1058 ? February 25, 2006, 1:04 am
Norton CE detects virus in C:\Recycler... October 24, 2008, 2:29 pm
Avast AV critical vulnerability (FrSIRT) July 21, 2005, 2:26 pm
Adaware critical object found May 17, 2006, 8:07 am
RE: Adaware critical object found May 17, 2006, 11:19 pm
Please Help! Problem with Start Up!! August 27, 2005, 11:35 am
Fails to start August 2, 2006, 2:18 pm
start Page virus December 30, 2005, 9:11 pm
rundll error message at start up September 5, 2008, 9:11 am
Where does Trojan-downloader.win32.Agent.bkd start up? June 17, 2007, 9:33 pm

The site map in XML format XML site map

Contact Us | Privacy Policy