Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite
1

Today I've tried to start the Visual Studio Developer IIS as usual on Port 80, but this time it has quit with an error that port 80 is already in use. With netstat I've found out, that an application C:/Windows/System32/ntoskrnl.exe is using port 80. My OS is Windows 7 Prof. SP 1.

Has anyone an idea why this application is blocking port 80? Testing ntoskrnl.exe on https://www.virustotal.com/ has found no infections.

share|improve this question
1  
Have you tried visiting localhost in a browser? – Rook Apr 3 '12 at 15:44
What kernel are you using? It's likely that someone "impersonates" the NT kernel and that your real kernel has one of the common alternate names (such as ntkrnlpa.exe). Check whether ntoskrnl.exe on your system is even a native image or perhaps GUI/CUI. – 0xC0000022L Apr 3 '12 at 20:07
Post that as an answer and accept it. – CodesInChaos Apr 4 '12 at 9:06
ok, thanks for your advice. (I have to wait 20h until I can accept the answer...) – user646062 Apr 4 '12 at 10:56

2 Answers

up vote 5 down vote accepted

I've found out that there was an instance of IIS running on my system (not the developer version that is started by Visual Studio, but the standalone version that can be installed via "Turn Windows features on and off"). This causes ntoskrnl.exe to use port 80. Sorry for the false alarm ;)

share|improve this answer
up vote 3 down vote

Hmm ntoskrnl.exe is the windows Kernel and honestly it doesn't have a very good reason for binding to port 80. It is a common target of advanced malware and viruses so I would be weary, but as usual it could be a false positive.

Try restarting, then apply all windows updates, then restart again. Is it still bound to port 80? If so I would repair it with the original versions from your installation DVD like so:

Insert the DVD and boot to it
Open a command prompt.
Restore ntoskrnl.exe and ntkrnlpa.exe from the DVD to %windir%\system32\

You will want to run updates again after restoring those files.

Let me know what you find! Hopefully its just a fluke :)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.