System Process PID 4 is listening on port 80

I wanted to save the SHSH signatures from my iPhone before updating to iOS 5.01. I started Tiny Umbrella but it showed an error indicating that there’s already a process listening on port 80:

Cannot Start TSS Service | DO NOT TRY RESTORING YOUR DEVICE!!! | System(PID:4) must be killed!!

I verified this using netstat (netstat –aon | find /I “LISTENING” | find /I “:80”):

netstat -aon | find /i "LISTENING" | find /i ":80"

 

A telnet to port 80 showed there was indeed a webserver running:

SNAGHTML5f0f8e2e

The fact that the webserver is running in the system process means that it needs to have System Privileges. It could be either a Service or, less friendly, some kind of malware DLL that injects itself.

I checked with Process Explorer which DLL’s are loaded into the System Process and this didn’t reveal any strange DLL’s:

System Process | PID 4 | Loaded DLL's

So a service seemed most likely but I didn’t have any of the usual suspects (in most likely order):

  • IIS Admin Service (Internet Information Server)
  • SQL Server Reporting Services
  • Apache Tomcat 7

But in my case it was the “Web Deployment Agent Service” (MsDepSvc) which is installed by Microsoft WebMatrix.

Was once an enthusiastic PepperByte employee but is now working elsewhere. His blogs are still valuable to us and we hope to you too.