在WINDOWS上如何查看某个端口上运行的是什么程序？

[binscut]

我扫描发现机器上有许多非常规网络端口打开了，有什么办法是什么程序在用这些端口？很有可能是木马程序。

[holyoe]

Netstat －A
FTP端口：21；
TELNET端口23
SMTP端口25
DNS端口53
HTTP端口80
POP3端口110
WINDOWS中开放的端口：139；
除此之外，若还有其他端口开放，就应引起重视，进一步判断是否为木马入侵。以下列出几个流行的木马所使用的通信端口有的木马端口可以重定义下面只是其默认端口
BO31337YAI1999DEEP THROAT21403150NETBUS12345冰河7626SUB7124327374

[binscut]

有什么办法是什么程序在用这些端口？

[binscut]

我已经找到工具了，在
http://it.rising.com.cn/safety/syjq/fhzq/020614checkport.htm

[aznarble]

在Windows XP下使用netstat和tasklist可以检查特定软件使用某个端口。以下是Windows专家Mark Minasi撰写的文章，供参考。

Use XP's New Netstat and Tasklist To Find Out Who's Talking To Your Computer
Here's a neat feature that I really like about XP: Netstat's new -o option.

If you don't know Netstat, then you should. It reports to you all of the network connections that your system has open at the moment. I used to use it with the -a option. -a says to show all network connections. The new -o option says to identify the process ID ("PID") of the program that started that connection. For example, under Windows 2000 I might have typed netstat -a and gotten a line like this in the output:

TCP GX240:1844 64.4.13.224:1863 ESTABLISHED

Unraveled, this line says that my workstation (GX240) is connected via port 1844 to some system at 64.4.13.224. Hmmm, I'd say, what's going on here? I don't remember agreeing to open up a link to someone out on the Internet. Is this some evil worm? Sure wish I could figure out WHICH program told my workstation to open this link. Well, of course, as my workstation is running XP, I can with the -ao switch. The output (excerpted) now looks like

Proto Local Address Foreign Address State PID ...
TCP GX240:1844 64.4.13.224:1863 ESTABLISHED 2132

Ah, there's the culprit -- whatever's running on process ID 2132. But how do I find out what that is? With another XP command-line command, tasklist. I could just run tasklist and pick out the program with PID 2132, but here's a way to get a somewhat cleaner output, using tasklist's "/fi" (filter) command. I'd type

tasklist /fi "pid eq 2132"That would yield this output:

Image Name PID Session Name Session# Mem Usage
========================= ====== ================ ======== ============
msmsgs.exe 2132 Console 0 3,848 KAha! "msmsgs" is Windows Messenger. It keeps a line open to a Microsoft server so that if someone wants to establish a Messenger session with me then my system will know to respond.