port scan results

[hornet]

I am new to port scanning and all those types of things and I trying to learn as much as I can about internet and network security, I have a copy of XP that I got yesterday and have done some port scans on it to test the build in fire wall and it shows open ports, how can I found out what these ports are:

135 DCE endpoint resolution
1025 Network Blackjack
5000 ?

I dont know what these results mean, any help would be great.

[stflook]

It means Windows XPs firewall is terrible and you should go back to whatever OS you were using before.

[styr3nz]

For a list of ports goto :

www.iana.org/assignments/port-numbers

You can then refer to RFC's for info about ports, protocols etc:

www.rfc-editor.org

[Simon Templer]

hornet

I have a hypothesis as to why those ports are open...I've read about the new feature in Windows XP that allows individuals the ability to get help by remote access. I wouldn't be surprised if those ports correspond to those used by the remote help option.

I haven't been able to find any articles or document that list the ports used by the remote access help. though

<------------------------------------------------------------->

If your curious what those ports could be being used for, I can give a brief explanation for each.

DCE endpoint resolution (135) - From what I understand Distributed Computing Environment (DCE) provides sharing capabitlies between different hardware and software platforms. It provides services such as File Sharing, etc.
You can go here to learn more about DCE:
http://www.transarc.ibm.com/Library/..._dce_main.html

Port 1025 - This port has been know to be used by the Trojans Fraggle Rock and Remote Storm
You can go here for more information on those:
http://www.simovits.com/sve/nyhetsar...heter9902.html

Port 5000 - When I researched this port in the port database it returned the following Trojans that use port 5000:
Bubbel
Back Door Setup
Sockets de Troie
Blazer5

Again...I'm not sure how much this has helped..but if you do find out the uses for the ports, and it is in regards to XP..let us know

[casper3699]

I have a hypothesis as to why those ports are open...I've read about the new feature in Windows XP that allows individuals the ability to get help by remote access. I wouldn't be surprised if those ports correspond to those used by the remote help option.

That would be kinda scary. If they wanted to they could access more files than they would really need to figure out what is wrong. They would heve full access to your computer.

[bAgZ]

Some ports may be open for users that need remote help. I actually played with this shortly. Bassicaly if you have a problem you request a remote help and then who ever is helping you out would disable your keyboard and mouse remotely. After that they could do whatever they want on the machine. Scary ...

[Type_0_Giz]

One thing you must do NOW is diable them ports.
Go into the regedit

Start/run/regedit
and search for P.C.Anwhere

This is installed be default under all XP systems.

Open the key and set the port to 0 for all connection Listening.

Then reboot.

go to

start/run/netstat -a

There should now be no open ports.
Install a fire wall for all ports and that is you save as houses.

Type_0_Giz