Why is System listening on port 8000?

Solution 1:

IIRC, any program that uses the HTTP Server API to run an HTTP server on Windows will have that service charged to the System process because it's running through the kernel's http.sys server.

You can see the registered URLs by running the following command: netsh http show servicestate. This will include the port number as well.

netstat -ab can also reveal which services started listening on a given port.

Solution 2:

A little late maybe but this thread came up quite high on my google search, and seemed most relevent though lacking that final piece of information i found useful.

You can see the (dynamically)registered url's by running the following command: netsh http show servicestate

Solution 3:

A bit of googling shows WCF example applications using 8000, and the Intel Remote Desktop Interface. I wouldn't expect these to be running as system.

There are a few trojans / backdoors that use 8000, so perhaps booting an Antivirus disk and doing a full scan would be a good idea.