Port 109 Mystery
James C Slora Jr
Jim.Slora at phra.com
Thu Mar 13 03:52:36 GMT 2003
Douglas Brown wrote Wednesday, March 12, 2003 11:55
> 220 winlogon -> 109 TCP \??\C:\WINNT\system32\winlogon.exe
This output does not indicate confusion about the path. It just means
c:\WINNT\system32\winlogon.exe, and it is the normal path reported for
Winlogon by fport and other utilities.
As to why it is reported like that, here's a quote from
" For some reason, the path names returned by GetModuleFilenameEx or the
TOOLHELP32 module functions are very strange; they don't follow the Win32
standard. For example, smss is retrieved as "\SystemRoot\System32\smss.exe";
"\SystemRoot must be replaced by the actual name of the Windows folder. For
winlogon, you get "\??\C:\WINNT\system32\winlogon.exe," which should be
translated into "C:\WINNT\system32\winlogon.exe." The \??\ prefix might be a
leftover from the Windows NT namespace root, essential in kernel mode, even
though it is rarely used at the Win32 programming level. "
So don't worry about the path reported by fport. The TCP 109 looks rather odd,
though. I don't know the answer to that.
More information about the unisog