Announcement

Collapse
No announcement yet.

rexec Service in XP

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • rexec Service in XP

    One of our security scans are showing rexec service enabled on one of the XP systems. Now, rexec is not a service in XP and the only thing XP has is the rexec client files. The user on the system does not even use rexec.

    Does anyone have any idea how to remove or disable this supposed rexec service in XP? Thanks.

  • #2
    Re: rexec Service in XP

    It could just be that the host in question has selected the rexec port for initiating communication to another host, although this would be unusual as the ephemeral ports are 1024 and above. You can find out what process is using this port by running netstat. You can run "netstat -a -o" to get a list of the PID's associated with each connection and then use task manager to find the process that corresponds to the PID.

    Comment


    • #3
      Re: rexec Service in XP

      Check what applications are installed on the specific computer.
      But first, I would check the Task Manager and see that if rexec is running. After all, it might be a false positive...

      Sorin Solomon


      In order to succeed, your desire for success should be greater than your fear of failure.
      -

      Comment


      • #4
        Re: rexec Service in XP

        In netstat, I see the following, which is referring to rexec. I'm not sure why it's listening. There is no PID available.

        Anyone know how to stop exec from listening? Thanks.

        TCP 772 <machine>:exec <machine.dns>:0 LISTENING

        Comment


        • #5
          Re: rexec Service in XP

          Be sure to run the netstat command as joeqwerty asked, with -a -o parameters. On the right-most column of the list you receive as output you should see the PID.
          Please try again and post here the results.

          Sorin Solomon


          In order to succeed, your desire for success should be greater than your fear of failure.
          -

          Comment


          • #6
            Re: rexec Service in XP

            Sorry, I looked at the results wrong. The PID was 772, which was some really old application (part of an older generation of Tivoli) which for whatever reason was listening on port 512 (rexec).

            Thanks for the help!

            Comment


            • #7
              Re: rexec Service in XP

              Cool, I am glad you found the answer.

              Sorin Solomon


              In order to succeed, your desire for success should be greater than your fear of failure.
              -

              Comment

              Working...
              X