Windows IP Helper service listening on port 1000

Question

On a Windows 10 Home machine (21H2 19044.1741), I noticed one of my applications failed to listen on port 1000, because something was already using that port. That struck me as peculiar, because I wasn't familiar with any applications that use 1000 by default.

I ran netstat -ano to get the PID of the process using port 1000.

That yielded the following process in my Task Manager...

I turned to google to investigate the Windows IP Helper, but was unable to find results that mention this specific port.

If I run nmap against the machine using nmap -v -p1000 -Pn I receive the following results...

Perhaps I'm not looking in the right places, but I'm unable to turn up search results for what cadlock is either.

I was able to Stop the IP Helper service from the Services menu, which did indeed free up the port. This behavior persists restarting the computer.

My questions are:

• Why is this service bound to this port on my machine? I've been unable to recreate this issue in a virtual machine or other bare-metal Windows machines.
• Could this be malware?
• How can I investigate this issue further?

Thank you.

Answer 1

Nmap does not have service probes for cadlock, so the service is detected based on the port number, alone. The port 1000/tcp is IANA assigned for cadlock2, but it could be used by anything; including several trojans.

It does not seem normal that Windows IP Helper service would be listening on this port, either.

Answer 2

Looking at the documentation for the Windows IP Helper, I found the function CreatePersistentTcpPortReservation:

The CreatePersistentTcpPortReservation function is used to add a persistent reservation for a block of TCP ports.

Applications and services which need to reserve ports fall into two categories. The first category includes components which need a particular port as part of their operation. Such components will generally prefer to specify their required port at installation time (in an application manifest, for example). The second category includes components which need any available port or block of ports at runtime.

So it seems likely that some application on your machine has requested a persistent reservation of TCP port 1000. (Perhaps someone else may be able to shed some light on which application could have done this?)