Process ID zero on Windows
I am learning how to analyze what a Windws system is doing based on looking at processes and network connections.
One system I just ran across has Process ID zero with multiple connections to external IP addresses (most Yahoo registered) on port 80. This has me suspicious as I assume process ID zero (PID 0) would be one of the first processes to run at startup and would be unlikely to ever need to talk to anything on the Net.
Can someone explain this or am I potentially looking at a system with unauthorized software running and hiding?
Software/Hardware used:
Windows XP SP3
One system I just ran across has Process ID zero with multiple connections to external IP addresses (most Yahoo registered) on port 80. This has me suspicious as I assume process ID zero (PID 0) would be one of the first processes to run at startup and would be unlikely to ever need to talk to anything on the Net.
Can someone explain this or am I potentially looking at a system with unauthorized software running and hiding?
Software/Hardware used:
Windows XP SP3
ASKED:
April 23, 2010 4:16 PM
UPDATED:
April 23, 2010 6:32 PM
RELATED QUESTIONS
- Windows 7 Troubleshooting difficulties
- Need a Sample of Logical Network Design
- Can Visual Basic be used to control a piece of mechanical equipment?
- How do I configure VMware guestOS(s) to talk to Vista Home Premium as a Host to access DB2 or any other database?
- How to find the processes linked to a service
Answer Wiki:
I found something similar a few months ago while using <a href="http://technet.microsoft.com/en-us/sysinternals/bb897437.aspx">Sysinternal's TCPView</a>, and after some research I found this (but this is exclusive for TCPView, so if you are using other monitoring software this might not apply):
"Notes - Svchost.exe is related to various Windows Services. A Remote Address of *.* means the port is open but not connection to anything. TCPView may show that the System Idle process (PID 0) is using some TCP ports. This behavior may occur if a local program connects to a TCP port, and then stops. The program's TCP connection to the port may be left in a "Timed Wait" state even though the program is no longer running. In this case, TCPView may detect that the port is in use. However, TCPView cannot identify the program that is using the port because the program has stopped and the PID was released."
-CarlosDL
----------
To see all answers submitted to the Answer Wiki: View Answer History.
RSS - Discussions Help
Discuss This Question:
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
