Port Scanning

[jw72253]

I installed Spybot S&D 2 on Windows XP Pro OS connected to my typical home network. I use a couple of other programs to monitor network connections, programs like netstat, Process Explorer, etc. These programs allow me to see all the TCP and UDP connections being made on my local machine. Now, since installing S&D 2, I can observer the S&D program appearing to interact with "every" single port on my system through localhost on 127.0.0.1. In appears for most of them as simply Waiting Connections and the state is Time Wait. It does this starting from the first port and continues sequentially through all the ports on the machine, and then it starts over. It takes them a group of ports at a time, nonstop, continuously.

Needless to say, all of this interference is extremely distracting and apparently unnecessary. Can anyone explain what this is caused by and how to prevent it? It certainly interferes with my need to observe valid connections using netstat, etc. If it cannot be stopped, I will have to remove S&D 2, and either put an earlier version on, or replace the program. Any ideas are welcome. Thanks.

[jw72253]

I have found that this program from the new version of S&D 2 is causing the problem: "SDFSSvc.exe". It is called the SD Scanner Service.

The problem stops when I terminate that program from Process Hacker. I don't know whether it is acting normally or this is something that you intend to change. It does appear as if the service is actually scanning all the ports in succession with the effect as I described it. The problem is not only showing up in Process Explorer. I see it in netstat too. If it is not corrected, this would be a deal breaker as far as I am concerned. I don't want to see all the ports flashing like a christmas tree. I really hope that you can fix this issue.

[jw72253]

Okay, I have decided that this is not as much of a problem as I first thought. I can live with the appearance of port connections by S&D during the scanning process, but I also think this procedure could be made more informative as to its purpose. I mean, if S&D is responsible for the port scanning, then why not put S&D as the source process instead of showing System Process on all of them except the one or two that do show up as S&D intermittently?

Also, I would really like to see a way to have netstat not show up all this scanning activity. Can that not be done?