[Solved] What is Allow 9009 on Firewall? Virus or Port Issue? Win10 Pro, TCP Port 9009, Pichat Service

I have exactly the same problem:
https://www.bleepingcomputer.com/forums/t/642063/keep-seeing-something-hosted-on-port-9009/

and followed the instructions therein. It didn't do anything.

Commonly in the firewall I have an attempt to output something called ALLOW and it connects only to TCP port 9009. I have no clue what it is. Win10 Pro (ori) system and zero installed goodies.



I got in here:
http://www.ipfingerprints.com/portscan.php
and I have this result:

Note: Host seems down. If it is really up, but blocking our ping probes, try "Don't Ping" in advance mode.
Host is up!
PORT STATE SERVICE
9009/tcp filtered pichat
9009/udp open|filtered pichat

TCPview only shows this:

Hello. Run the command line as administrator and enter the command:
netstat -n -a -b

It should display all listening processes and connections established at the moment. See if you can identify a process that is listening on port 9009.

Do a FRST scan: https://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/ - don't change any parameters. Upload both generated logs (FRST and Addition text files) as attachments.

In cmd it doesn't show anything. Everything is ok there. There is no 9009 Allow listener and the rest is from Firefox and from the system.

I guess a bunch of (from my perspective) redundant LED control software might be using port 9009 for communication. RGB Fusion has a smartphone app that communicates over this port, so I wouldn't be surprised if the software took care to keep it open.

I put a clean system straight from M$. Te Allow is from Microsoft. I put a clean W10, depriving it only of telemetry, defender, antimalware and a few other reptiles. I put in a firewall and it still pops up connecting to port 9009.
So I blocked this port in the firewall in UDP and TCP and we'll see what it does.

It turned out to be a service related to the so-called. GCloud is some garbage from Gigabyte packed in APP-Center. I got rid of it and nothing similar to Allow 9009 speaks anymore. It's ok.