Member Avatar for Greenhills

I tested a friends computer at www.grc.com (Steve Gibson's Shields Up!). According to the port scan test, he has port numbers 135 (RPC?) and 1024 (DCOM?) wide open, whilst my computer is running in full 100% Stealth mode. I'm running XP Professional with ZoneAlarm Personal, he's running XP Home with McAfee firewall.
He hasn't any problems with "computer bugs" and he's has all the latest Windows updates installed.
Is this an operating system issue, a firewall problem or something else?
I'd welcome your feedback.

Thanks.


Greenhills.

  • 3 Contributors
  • 2 Replies
  • 81 Views
  • 1 Month Discussion Span
  • Latest Post Latest Post by crunchie

Dani AI

Generated

A short troubleshooting guide based on the thread: noted a Shields Up scan that showed Windows service ports responding from an XP Home machine while an XP Pro box with ZoneAlarm was reported as stealth. correctly observed that an open listening port is not itself a compromise, but it is an attack surface. suggested checking the third‑party firewall and noted that some firewalls (and alternatives such as Sygate or ZoneAlarm) default to a stealth posture.

A useful isolation sequence:

  • Enumerate local listeners and map them to processes to see what actually answers the scan.
netstat -an
netstat -ano
tasklist /svc
  • If a listening PID is svchost.exe, use the tasklist output to identify which Windows service is hosting it (RPC-related services commonly use shared hosts). Avoid disabling core services such as Remote Procedure Call; doing so will break system functionality.
  • Inspect the McAfee firewall inbound rules and any “stealth/block unsolicited inbound” options. Some personal firewalls allow system services by default; changing that policy can stop scan responses.
  • Check the network edge: router NAT, explicit port forwards or UPnP mappings can expose ports even when a host firewall is present.

Final notes: achieving “100% stealth” generally requires either a host firewall configured to block all unsolicited inbound traffic or relying on a NAT device with no forwards. For forensic clarity, collect netstat output and firewall logs to determine whether the responses come from the PC itself or from upstream network equipment.

Recommended Answers

All 2 Replies

Member Avatar for mikeandike22

it doesnt matter i have ports open to but it doesnt do much to your computer as long as you dont mess around with your ports to much

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.