Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Today I've tried to start the Visual Studio Developer IIS as usual on Port 80, but this time it has quit with an error that port 80 is already in use. With netstat I've found out, that an application C:/Windows/System32/ntoskrnl.exe is using port 80. My OS is Windows 7 Prof. SP 1.

Has anyone an idea why this application is blocking port 80? Testing ntoskrnl.exe on https://www.virustotal.com/ has found no infections.

share|improve this question

closed as off-topic by Noordung, NULLZ, Xander, Scott Pack, AviD Dec 10 '13 at 20:33

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions about general computing hardware and software are off-topic here, but can be asked on Super User." – Noordung, NULLZ, Xander, Scott Pack, AviD
If this question can be reworded to fit the rules in the help center, please edit the question.

1  
Have you tried visiting localhost in a browser? –  Rook Apr 3 '12 at 15:44
    
What kernel are you using? It's likely that someone "impersonates" the NT kernel and that your real kernel has one of the common alternate names (such as ntkrnlpa.exe). Check whether ntoskrnl.exe on your system is even a native image or perhaps GUI/CUI. –  0xC0000022L Apr 3 '12 at 20:07
    
Post that as an answer and accept it. –  CodesInChaos Apr 4 '12 at 9:06
    
ok, thanks for your advice. (I have to wait 20h until I can accept the answer...) –  user646062 Apr 4 '12 at 10:56

3 Answers 3

Hmm ntoskrnl.exe is the windows Kernel and honestly it doesn't have a very good reason for binding to port 80. It is a common target of advanced malware and viruses so I would be weary, but as usual it could be a false positive.

Try restarting, then apply all windows updates, then restart again. Is it still bound to port 80? If so I would repair it with the original versions from your installation DVD like so:

Insert the DVD and boot to it
Open a command prompt.
Restore ntoskrnl.exe and ntkrnlpa.exe from the DVD to %windir%\system32\

You will want to run updates again after restoring those files.

Let me know what you find! Hopefully its just a fluke :)

share|improve this answer
up vote 5 down vote accepted

I've found out that there was an instance of IIS running on my system (not the developer version that is started by Visual Studio, but the standalone version that can be installed via "Turn Windows features on and off"). This causes ntoskrnl.exe to use port 80. Sorry for the false alarm ;)

share|improve this answer

I was experiencing similar symptoms where port 80 was being used by the ntoskrnl process. In my case, the Web Deployment Agent Service was hogging port 80. I fixed it by disabling the service and changing its startup type from automatic to manual. See http://www.sitepoint.com/unblock-port-80-on-windows-run-apache/.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.