closing open TCP ports under WinXP SP3

Question

I must confess I have not been very security-conscious over the last few years, and I just did an NMAP scan of my computer to see how it was doing. The results amazed me. There were literally thousands of ports open, and most of them were for processes I never use, and some of them look like rootkits/backdoors (such as process bigbrother running on port 1984), so I was wondering if there was any way to shut down open ports with Windows or DOS, or do I have to use a utility, if there is one. Thanks

Answer 1

If there are that many open ports, you’ll have to find out what is opening them. You’ll also need to understand what they are for (browsers usually have dozens and dozens of open ports, but that’s not a problem, per-se).

To start, run TCPView or CurrPorts to get information on open ports. Sort on the process column and see what programs have open ports. If you’ve got a browser open, you’ll want to close it and wait a while until its ports have closed in order to reduce the clutter. (Once a port is closed or a program ends, it remains in the list for a while in the TIME_WAIT state under (System Process). (It should go without saying that any and all P2P programs will need to be close since they will have a lot of open ports, thus cluttering the display like crazy.)

What you particularly want to look out for is connections that are LISTENING because they are servers.

See what other programs have open ports and close everything that is legitimate, ie a program that you knowingly run and are aware uses the Internet like chat programs and such.

Once you’ve reduced the ports to a hopefully smaller number, see what’s left. You’ll probably have a couple of SVCHOST.EXE instances at a minimum.

If you’ve still got a lot, you’ll want to consider running some malware detectors/cleaners in case you’ve an infection. (There are lists of recommended programs here.)

Next, you’ll want to close NIC-specific ones. Open Network Connections in the Control Panel, double-click your network adapter, then Properties, then double-click TCP/IP, then Advanced, and finally WINS tab. Here you can choose to disable NetBIOS, which would close another port. If you don’t know for sure that you need it, then give it a try because you can just set it back if you have trouble with your Internet connection.

You can also get Windows Worms Doors Cleaner to view open ports and use it to close several high-profile ones.

While you’re hardening Windows XP, you may as well get XP-Antispy since it will help disable or change several options to make Windows less “sloppy”, as it were.

At this point, if you still have open ports, then it depends on which ports they are and what process they are from. They may another Internet-connected program that you had forgotten about, they could be from the system, or they could be malware. You’ll have to list them and/or look them up for more information.

If you want, you could also monitor the connections with a sniffer like SMSniff, Network Monitor, or WireShark to view the contents of the packets to see what’s really going on.

(Once you’ve got your system sorted out, you should consider getting either a software firewall or a router with firewall functionality—the preferred solution—to prevent future problems.)

Answer 2

• Did you scan localhost?

  Some programs use TCP for inter-process communications; the ports they listen on are only accessible from your own computer (i.e. 127.0.0.1 and ::1) and not over the network. They are safe.

• Do you have a firewall enabled?

  The firewall built into Windows XP SP3 is very effective at blocking incoming connections to unwanted ports. Start firewall.cpl and enable it.

• Can you compare the list with the one given by, for example, currports or netstat -ano | find "LISTENING"?

• nmap does not know what exactly is running on tcp/1984. It just happens that "Big Brother" was the first widely used program to use this port by default, and it got an entry in nmap's services file. In reality, it might be anything on that port.

  Try the protocol detection feature in nmap -sV, or write down the process IDs displayed by CurrPorts/netstat and find them in Process Explorer. See below.

• The way to shut down an open port is to close the program that is listening on it.

  Process Explorer and/or CurrPorts can help you with this.

• _{DOS is an entirely separate operating system. It does not even have TCP/IP. You cannot shut down Windows processes from DOS. If you meant the "Command Prompt", keep in mind that it's 100% Windows.}

Answer 3

You would want to install a firewall (don't just use the one built in to windows), and configure it to block all incoming connections that you did not initiate. Zonealarm or Comodo would be good picks.

However, if your computer is already suspected to be rooted, you may wish to reformat, patch fully, and set up the firewall, to ensure that whatever lovely malware you have lying around isn't sneaking in and punching holes in your firewall.