Printable View
A little question,
I have found two unknown services open when port scanning my home PC which is running Windows XP professional. They are UDP port 445 (IOC SRV) and TCP port 135 (MSDS). Anyone have any ideas as to what activity is being conducted upon them ? And what web sources are you using to lookup port numbers and their assigned services, apart from IANA.
Thanks in advance,
Wurzul
I can't give you much info...but I can tell you what services use the two ports in question.
Port 445 is Microsoft-DS, Windows XP and 2000 use this port for file sharing.
Port 135 is DCE endpoint resolution. This is also a microsoft file sharing port.
I hope this helps you a little.
Netstat with the -o paramater should show you the processes that are controlling those ports.
Check out this thread.
Using 'shields up' at https://grc.com/x/ne.dll?bh0bkyd2 I got this report.
135 RPC
OPEN! (Remote Procedure Call) This impossible-to-close port appears in most Windows systems. Since many insecure Microsoft services use this port, it should never be left "open" to the outside world. Since it is impossible to close, you will need a personal firewall to block it from external access. Do it soon!
445 MSFT DS
OPEN! This impossible-to-close port first appeared on Windows 2000 and was carried over to Windows XP. Since several insecure Microsoft services use this port, it should never be left "open" to the outside world. Since it is impossible to close you'll need a personal firewall to block it from external access. Do it soon!
Still not very informative though.
Thanks for everybodys help
I heard RPC is exploited a lot, but I don't know to what extent.
im not sure what ports XP uses for this, but I do know that XP is known to "check-in" with Microsoft. This is done, behind the scenes and is not known for sure what it is talking to micro$oft for. Like stated before, A personal firewall can close these ports off to intruders, and some firewalls like zonealarm and sygate will actually allow you to keep the computer from communicating to micro$not......I also have a program which will allow you to configure xp to not communicate with the "mother ship" if you want this program, pm me. I hope this helps some.
Well, the website you found your answers from doesn't have their story exactly straight. It is possible to close both of those ports, but not without a little pain. One good write up about the procedure to close both of these ports can be found here:
http://www.gpick.com/tq/TQ_Page1.htm
Look at numbers 14 and 15. Be forewarned, there is some loss of functionality if you follow these steps, but there is also increased secuurity. Only you can decide the correct balance.