Printable View
epmap 135/tcp DCE endpoint resolution . Everytime i go through and disable all of the services i dont want running, i go back and check through netstat -an, and i always find Tcp port 135 running does anyone know a way to manually close this port(or are you not supposed to) . I dont windows allows you to disable the RPC service though, only the RPC locator.
You can find all of your answers here I hope
http://www.experts-exchange.com/Secu..._20495172.html
http://search.earthlink.net/search?a...s&q=Port%20135
The most obvious ways would be to just block it using a firewall.
I believe that port 135 is used by messenger. Simply goto control panel, then admin. tools.
go into services and disable the messanger service, and stop it.
Here is a good explination of why you'd want to disable it.
See if that port is still open... it shouldn't be.
There is another way here. Though it is a bit more complicated...
I have already disabled messenger through services.msc. I should have mentioned in the previous post that i am using a firewall. I have already tried disabling this port through the registry >>HKEY_LOCAL_MACHINE>Software>Microsoft>OLE, and changing the EnableDCOM value to N, but its still showing up in netstat -an. That method is supposed to disable it. Im gonna try out the method in the link you posted phishphreek.
Port 135 cannot be closed. The only way to do it is to install a firewall. If you got windows XP, just turn on the windows firewall, otherwise tiny personal firewall is good (and free), but needs a bit of configuring to get set up properly. Zone Alarm is also free, and needs hardly any configuration at all. There are other firewalls out there, just take your pick on which one you want to use.
HTH
Quote:
Beryllium9 said: Port 135 cannot be closed.
For earlier products (NT, 98/95) I don't believe you can close port 135 although you can block it with a firewall (ZoneAlarm, Outpost, TinyFirewall are all good freeones). With the 2000/XP family of products I believe you can close down port 135 (and 137 and 139) by stopping the Messenger service.
I am using XP and I have never been able to block the port 135 by another way than through a firewall.
After I have done some search about it, I discovered that this port is used by Windows for some endpoints resolution. So, it's more than being simply related to messenger service.
KC
Weird. I know the machines at work -- Windows XP Pro -- have 135/137/139 off. So somehow they did it. Perhaps a registry setting then. ;)
>Try this link it might have what your looking for.
> http://www.securityspace.com/smysecu...t.html?repid=4
>
>Hope that helped.
I also found this one:
http://www.uksecurityonline.com/husd...0/close135.htm
Thanks for the article MsMittens. I will try to stop this port on my system.
I know its been said before but I would get a firewall. Not having one is not a good idea. Yea read up and maybe close that port on your own but still get a firewall
I already stated that i have a firewall.
Thanks for all the information Guys/Girls you really helped me out here and i appreciate it.
Do this on XP Pro:
START -> RUN -> dcomcnfg.exe
Click on Component Services, then right click on My Computer.
Choose Properties
Choose the Default properties tab
Take the check out of: Enable Distributed COM on this computer.
You're all set!
I use a nice little program called TCPView 2.3 from www.sysinternals.com. It maps out the service keeping the ports open and svchost.exe is behind 135.
Putting up a FW seems to be the logical way to help combat this. I use Proport.exe (tdupage.com) and it would tell me a host of "listening" sites and a couple of ports that were established.
i messed up my comp to the point of formatting the C: drive and have since reinstalled everything and using the FW (I use ZA free) and not seen any more "listening" ports though i get scanned a lot.