Microsoft Telnet on port 25
dugbrown at email.unc.edu
Tue May 13 16:41:04 GMT 2003
We've seen a few systems that have had the Microsoft Telnet server
service started and listening on port 25 (rather then port 23) - FPort
Pid Process Port Proto Path
720 tlntsvr -> 25 TCP C:\WINNT\system32\tlntsvr.exe
This service and port seemingly just appeared - in each case this was
something that the users did not start, and were not aware of. Some
users suggested that they had run WindowsUpdate recently. We've seen
this on both Windows 2000 and XP systems. Running tlntadmn.exe lists 25
as the port on affected machines, and 23 as the port on normal machines.
No accounts had been added to the machines.
Has anyone else seen anything along these lines? Any ideas?
Douglas Brown, CISSP
Manager of Security Resources
UNC Chapel Hill
"what can Brown do for you?"
More information about the unisog