I wanted to save the SHSH signatures from my iPhone before updating to iOS 5.01. I started Tiny Umbrella but it showed an error indicating that there’s already a process listening on port 80:

I verified this using netstat (netstat -aon | find /I “LISTENING” | find /I “:80″):

A telnet to port 80 showed there was indeed a webserver running:

The fact that the webserver is running in the system process means that it needs to have System Privileges. It could be either a Service or, less friendly, some kind of malware DLL that injects itself.

I checked with Process Explorer which DLL’s are loaded into the System Process and this didn’t reveal any strange DLL’s:

So a service seemed most likely but I didn’t have any of the usual suspects (in most likely order):

• IIS Admin Service (Internet Information Server)
• SQL Server Reporting Services
• Apache Tomcat 7

But in my case it was the “Web Deployment Agent Service” (MsDepSvc) which is installed by Microsoft WebMatrix.