I was doing a quick port scan at work (Nmap 6, OS X 10.6.8), and I noticed that nearly all of the computers around me were running a service called "netvenuechat" on Port 1023. Although I've searched through several forum posts and have found many others running the same service, I have not found a distinct answer as to the validity of this service.
Is this a normal background service, or is this service part of some malware?
Officially, according to IANA (the Internet Assigned Numbers Authority), port 1023 is "reserved", whether being used for TCP or UDP.
Many sites claim to list the known software packages (legit and malware) and well-known protocols that use various ports, and it's hard to know who to trust. However, this listing at SpeedGuide.net seems pretty legit, and lists the following known users:
If you aren't aware of people in your company running Nortel NetVenue or Microsoft NetMeeting (which used to be built into Windows, I think), and if it's likely people may still be running Windows XP or Windows 2000, then they could well be infected with the "Sasser" malware. Then again, it could be some other piece of software that happened to use that port.
Nmap does not have a service discovery match for netvenuechat, so that label is being applied as a simple lookup of 1023/tcp in the nmap-services file. If you want to find out what is actually running on that port, you can either perform a Service/Version Detection scan with the -sV option, or try to determine what process is listening by running commands on the target machine (all of these will require administrator/root privilege):
Windows commands: netstat -anb, SysInternals TCPView
Linux commands: netstat -tanp, lsof -n -i
