I finally found out what it was: hackerdefender There is a trick to seeing it which is to map a drive from another machine to an administrative...
A user had a number of instances of serv-u ftp server on an XP pro machine. I removed all the obvious ones. I ran tds3 the locahost port scan...
Separate names with a comma.