When you say "running in svchost", is that what it says when you run netstat -b?
"Svchost" is the "Server" service, so that doesn't tell you much, but you can narrow it down a bit further:
- run netstat -b again, and make a note of the number in the PID column (the Process ID), next to port 476.
- run the following command with admin rights, inserting the PID where indicated:
tasklist /svc /fi "PID eq the_PID"
That lists the programs or services using that PID. "tn-tl-fd1" is just the "well-known name" of port 476, it doesn't tell us which program opened it up.
Last edited by bnt; 18th November 2007 at 16:27.