Windows IP Helper service listening on port 1000
On a Windows 10 Home machine (21H2 19044.1741), I noticed one of my applications failed to listen on port 1000, because something was already using that port. That struck me as peculiar, because I wasn't familiar with any applications that use 1000 by default.
I ran netstat -ano to get the PID of the process using port 1000.
That yielded the following process in my Task Manager...
I turned to google to investigate the Windows IP Helper, but was unable to find results that mention this specific port.
If I run nmap against the machine using nmap -v -p1000 -Pn I receive the following results...
Perhaps I'm not looking in the right places, but I'm unable to turn up search results for what cadlock is either.
I was able to Stop the IP Helper service from the Services menu, which did indeed free up the port. This behavior persists restarting the computer.
My questions are:
- Why is this service bound to this port on my machine? I've been unable to recreate this issue in a virtual machine or other bare-metal Windows machines.
- Could this be malware?
- How can I investigate this issue further?
Thank you.
