I wanted to save the SHSH signatures from my iPhone before updating to iOS 5.01. I started Tiny Umbrella but it showed an error indicating that there's already a process listening on port 80:

Cannot Start TSS Service | DO NOT TRY RESTORING YOUR DEVICE!!! | System(PID:4) must be killed!!

I verified this using netstat (netstat -aon | find /I "LISTENING" | find /I ":80"):

netstat -aon | find /i "LISTENING" | find /i ":80"

 

A telnet to port 80 showed there was indeed a webserver running:

SNAGHTML5f0f8e2e

The fact that the webserver is running in the system process means that it needs to have System Privileges. It could be either a Service or, less friendly, some kind of malware DLL that injects itself.

I checked with Process Explorer which DLL's are loaded into the System Process and this didn't reveal any strange DLL's:

System Process | PID 4 | Loaded DLL's

So a service seemed most likely but I didn't have any of the usual suspects (in most likely order):

  • IIS Admin Service (Internet Information Server)
  • SQL Server Reporting Services
  • Apache Tomcat 7
But in my case it was the "Web Deployment Agent Service" (MsDepSvc) which is installed by Microsoft WebMatrix.