Microsoft Telnet on port 25

Douglas Brown dugbrown at
Tue May 13 16:41:04 GMT 2003

We've seen a few systems that have had the Microsoft Telnet server 
service started and listening on port 25 (rather then port 23) - FPort 

Pid   Process            Port  Proto Path
720   tlntsvr        ->  25    TCP   C:\WINNT\system32\tlntsvr.exe

This service and port seemingly just appeared - in each case this was 
something that the users did not start, and were not aware of.  Some 
users suggested that they had run WindowsUpdate recently.  We've seen 
this on both Windows 2000 and XP systems.  Running tlntadmn.exe lists 25 
as the port on affected machines, and 23 as the port on normal machines. 
  No accounts had been added to the machines.

Has anyone else seen anything along these lines?  Any ideas?

Douglas Brown, CISSP
Manager of Security Resources
UNC Chapel Hill
Abernethy 105
"what can Brown do for you?"

More information about the unisog mailing list