Why is System listening on port 8000?

IIRC, any program that uses the HTTP Server API to run an HTTP server on Windows will have that service charged to the System process because it's running through the kernel's http.sys server.

You can see the registered URLs by running the following command: netsh http show servicestate. This will include the port number as well.

netstat -ab can also reveal which services started listening on a given port.

A little late maybe but this thread came up quite high on my google search, and seemed most relevent though lacking that final piece of information i found useful.

You can see the (dynamically)registered url's by running the following command: netsh http show servicestate