I must confess I have not been very security-conscious over the last few years, and I just did an NMAP scan of my computer to see how it was doing. The results amazed me. There were literally thousands of ports open, and most of them were for processes I never use, and some of them look like rootkits/backdoors (such as process bigbrother running on port 1984), so I was wondering if there was any way to shut down open ports with Windows or DOS, or do I have to use a utility, if there is one. Thanks
If there are that many open ports, you’ll have to find out what is opening them. You’ll also need to understand what they are for (browsers usually have dozens and dozens of open ports, but that’s not a problem, per-se).
To start, run TCPView or CurrPorts to get information on open ports. Sort on the process column and see what programs have open ports. If you’ve got a browser open, you’ll want to close it and wait a while until its ports have closed in order to reduce the clutter. (Once a port is closed or a program ends, it remains in the list for a while in the TIME_WAIT state under
What you particularly want to look out for is connections that are LISTENING because they are servers.
See what other programs have open ports and close everything that is legitimate, ie a program that you knowingly run and are aware uses the Internet like chat programs and such.
Once you’ve reduced the ports to a hopefully smaller number, see what’s left. You’ll probably have a couple of
If you’ve still got a lot, you’ll want to consider running some malware detectors/cleaners in case you’ve an infection. (There are lists of recommended programs here.)
Next, you’ll want to close NIC-specific ones. Open Network Connections in the Control Panel, double-click your network adapter, then Properties, then double-click TCP/IP, then Advanced, and finally WINS tab. Here you can choose to disable NetBIOS, which would close another port. If you don’t know for sure that you need it, then give it a try because you can just set it back if you have trouble with your Internet connection.
You can also get Windows Worms Doors Cleaner to view open ports and use it to close several high-profile ones.
While you’re hardening Windows XP, you may as well get XP-Antispy since it will help disable or change several options to make Windows less “sloppy”, as it were.
At this point, if you still have open ports, then it depends on which ports they are and what process they are from. They may another Internet-connected program that you had forgotten about, they could be from the system, or they could be malware. You’ll have to list them and/or look them up for more information.
(Once you’ve got your system sorted out, you should consider getting either a software firewall or a router with firewall functionality—the preferred solution—to prevent future problems.)
You would want to install a firewall (don't just use the one built in to windows), and configure it to block all incoming connections that you did not initiate. Zonealarm or Comodo would be good picks.
However, if your computer is already suspected to be rooted, you may wish to reformat, patch fully, and set up the firewall, to ensure that whatever lovely malware you have lying around isn't sneaking in and punching holes in your firewall.