Shortcuts

Port 1043 Details

known port assignments and vulnerabilities

threat/application/port search:

Port(s)	Protocol	Service	Details	Source
1043	tcp	trojan	ASUS Armoury Crate "NodeJS Web Framework" process uses TCP ports 1042 and 1043 Dosh Backdoor.Win32.Mhtserv.b / Missing Authentication - Mhtserv.b listens on TCP port 1043, apparently there is no authentication required to access this backdoor. Accessing the backdoor using telnet you are greeted with a "Command" prompt, issuing a lowercase "L" char will get you a dir listing of system32. References: [MVID-2021-0059]	SG
1043	tcp	trojan	Dosh	Trojans
1043	tcp	boinc	BOINC Client Control or Microsoft IIS	Nmap
1043	udp	boinc	BOINC Client Control	Nmap
1043	tcp,udp	boinc-client	BOINC Client Control, registered 2004-11	IANA

5 records found

SG security scan: port 1043

jump to:

Related ports: 1039 1041

« back to SG Ports

External Resources
SANS Internet Storm Center: port 1043

Notes:
Port numbers in computer networking represent communication endpoints. Ports are unsigned 16-bit integers (0-65535) that identify a specific process, or network service. IANA is responsible for internet protocol resources, including the registration of commonly used port numbers for well-known internet services.
Well Known Ports: 0 through 1023.
Registered Ports: 1024 through 49151.
Dynamic/Private : 49152 through 65535.

TCP ports use the Transmission Control Protocol, the most commonly used protocol on the Internet and any TCP/IP network. TCP enables two hosts to establish a connection and exchange streams of data. TCP guarantees delivery of data and that packets will be delivered in the same order in which they were sent. Guaranteed communication/delivery is the key difference between TCP and UDP.

UDP ports use the Datagram Protocol. Like TCP, UDP is used in combination with IP (the Internet Protocol) and facilitates the transmission of datagrams from one computer to applications on another computer, but unlike TCP, UDP is connectionless and does not guarantee reliable communication; it's up to the application that received the message to process any errors and verify correct delivery. UDP is often used with time-sensitive applications, such as audio/video streaming and realtime gaming, where dropping some packets is preferable to waiting for delayed data.

When troubleshooting unknown open ports, it is useful to find exactly what services/processes are listening to them. This can be accomplished in both Windows command prompt and Linux variants using the "netstat -aon" command. We also recommend runnig multiple anti-virus/anti-malware scans to rule out the possibility of active malicious software. For more detailed and personalized help please use our forums.

Please use the "Add Comment" button below to provide additional information or comments about port 1043.

User Reviews/Comments:

rate: avg:

by anonymous - 2021-10-13 22:37

Asus Framework Service

by AsusROGSucks - 2024-02-10 11:17

I scanned my device using nmap and found two wierd ports open: 1042 and 1043. I traced it to the "ASUS NodeJS Web Framework" process belonging to a program called Armory Crate, which comes pre-installed with any ASUS ROG laptops. On the surface it allows you to customise your keyboard LEDs and wallpapers, monitor your fan speed etc.

IMO it's bloatware if not worse.

1) Here's several reddit posts full of angry ROG users saying Armory Crate caused them 10% CPU loads and powerspikes, essentially behaving like malware. Ever since I bough my laptop, I too have experienced powerspikes and overheating when the laptop is at rest. I never figured out what caused it, because nothing ever showed up in my task manager.

https://www.reddit.com/r/ASUS/comments/saz3jq/can_i_terminate_asus_nodejs_web_framework/?rdt=52051
https://www.reddit.com/r/ASUSROG/comments/nmkhei/how_to_completely_uninstall_armoury_crate/
https://www.reddit.com/r/ASUS/comments/f08kgb/too_many_asus_services_running_which_can_i_remove/

Most posts started 2 years ago, but people have been comming in reporting the same issues ever since.

2) It's extremely difficult to remove. Armory Crate consists of so many components that according to the offcial website, you cannot possibly uninstall it cleanly over the windows settings menu. Some Reddit commenters reported trying it, and it just kept comming back over and over again (not sus at all). Instead the offical website says you need to download a dedicated uninstallation tool and they give grave warnings that without Armory Crate your computer will stop functioning.

https://rog.asus.com/articles/guides/how-to-cleanly-uninstall-and-reinstall-armoury-crate/

3) I did it anyway, and everything seems completely fine. The LEDs still work, but as expected I can't change my settings and the shortcut for adjusting fanspeeds is gone as well. Still, the laptop performs just fine when gaming. I haven't seen any powerspikes since, but I did uninstall it rather recently, so time will tell. The suspicious ports are closed now, and while the uninstaller has left some Armory Crate processes still running, they aren't talking to the internet anymore.

So, if you still have Armory Crate doing god-knows-what on your machine, get rid of it :)