1

I've been to use port 8092 to use some propriety software my company has made, but it seems the port is in use. Further tracking it down shows the PID of the process using the port as 4 (which as I understand is a System process in Windows 7 Professional SP1 (x64)). I'm running on an HP ZBook 15 laptop. Viewing the process in the task manager shows it as "System" with PID=4. The image path name is "C:\Windows\System32\ntoskrnl.exe" and the description is NT Kernel & System. All efforts to kill this task have failed, as it is a system process (though I did get a BSOD crash when trying) According to this article, if this executable shows up as a process, it is a strong indicator of malware:

http://www.runscanner.net/lib/ntoskrnl.exe.html

I'd really like to avoid having to re-image this machine, as it is an involving process and I don't want me job looking at me like I'm incompentent. I don't know if this was my fault or not. I've run a variety of anti-virus and spyware programs from safe mode but wasn't able to find anything. The process remains. If anyone can help me get this figured out, I'll buy you gold, donate to your paypal, whatever. Thanks very much in advance for reading.

Improve this question
8
  • 2
    Frpm that article "Some malicious files may have the same name but be stored somewhere other than in %SystemRoot%\System32." The "System" is always PID 4, and that "System" process is the legitimate NTOSKRNL.EXE. The OS BSoD'd because you forced that process to stop (it needs to be running for the computer (system) to work -- it's the NT OS kernel). So far what you've presented seems nothing like an infection. What makes you think 8092 is ACTUALLY in use? Does it show up in the list put out by Netstat (netstat -aom)?
    – Ƭᴇcʜιᴇ007
    Sep 3, 2014 at 23:41
  • 1
    If it shows in Netstat, as System, PID4, then you have a driver/system-level process listening on that port, or a process running as System. Does it still show up if you use MSConfig to disable all 3rd party start-ups and services (and reboot)?
    – Ƭᴇcʜιᴇ007
    Sep 3, 2014 at 23:48
  • 1
    So I disabled all but the Microsoft services and all but the Intel startup items and the port is now unoccupied, which is great! So, I'm assuming the next move is to start re-enabling the services and startup items one by one until I can determine which one is using my port, correct? Thanks for the help. This gives me confidence that I won't have to re-image this machine to get around this issue.
    – Jesse Roper
    Sep 4, 2014 at 0:15
  • 1
    "I'm assuming the next move is to start re-enabling the services and startup items one by one until I can determine which one is using my port, correct?" Yup. :)
    – Ƭᴇcʜιᴇ007
    Sep 4, 2014 at 0:20
  • 1
    @EricMilas I ended up disabling "HP Support Solutions Framework Service" from the Services tab of System Configuration
    – Jesse Roper
    Dec 12, 2014 at 22:16

1 Answer 1

Reset to default
2

@Jesse Roper

Thank you for posting "HP Support Solutions Framework Service" was preventing Couchbase default install from starting by listening on 8092 from the process System (4) just as you described.

A clean install on an HP windows machine will start Couchbase but never starts listening on the admin port 8091 as it fails to obtain access to port 8092. Couchbase does a rather bad job of reporting the root cause, so if you are having issues, run the following command:

netstat -a -n -b -o

if you see this in the results:

 Can not obtain ownership information
  TCP    0.0.0.0:8092           0.0.0.0:0              LISTENING       4

Then run this command to see if the service is installed & running:

C:\>net stop HPSupportSolutionsFrameworkService

The HPSupportSolutionsFrameworkServiceservice is stopping.
The HPSupportSolutionsFrameworkServiceservice was stopped successfully.

Now attempt to start Couchbase as normal.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .