Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Firewall/Router?


  • Please log in to reply
14 replies to this topic

#1 ashpash

ashpash

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:09:03 PM

Posted 03 July 2004 - 09:48 PM

I have no firewall but have a Router and as far as I know all closed ports. However I have done a port scan recently and have port 80 open. Now I have a couple of questions.

Firstly is this port open when I'm surfing and closed when I'm offline or does this mean its constantly open?

If its constantly open then how do I close it and why is it open?

Would a Firewall do it?

I have Windows XP's firewall activated and I don't have a server running.

Any help would be appreciated.

Thanks

BC AdBot (Login to Remove)

 


m

#2 Grinler

Grinler

    Lawrence Abrams


  • Admin
  • 43,400 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:09:03 PM

Posted 04 July 2004 - 05:12 PM

Did you do the portscan from inside the network or outside the network?

#3 ashpash

ashpash
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:09:03 PM

Posted 04 July 2004 - 05:50 PM

I assume I used an outside scan as I scanned from a website not from a program on my computer.

#4 Grinler

Grinler

    Lawrence Abrams


  • Admin
  • 43,400 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:09:03 PM

Posted 04 July 2004 - 06:04 PM

Ok that it is most likely a port open on your router, which is probably the remote administration port for that router. if you go into the configuration of the router, one of the screens should have something that allows you to enable/disable remote administration. You want to disable it.

#5 ashpash

ashpash
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:09:03 PM

Posted 04 July 2004 - 06:52 PM

Dont mean to sound like a dummy here but where would I find my configuration for the router. I am using ADSL with a modem, dont really know what a router is just that I was told that's what I had by a friend of mine. Would I have to get in touch mith my isp?

Thanks

#6 Grinler

Grinler

    Lawrence Abrams


  • Admin
  • 43,400 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:09:03 PM

Posted 04 July 2004 - 06:56 PM

Well is the adsl modem connected directly to your computer? Or do you have the adsl modem plugged into another piece of hardware that your computer then plugs into?

#7 ashpash

ashpash
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:09:03 PM

Posted 04 July 2004 - 07:41 PM

Its plugged directly into my computer

#8 ashpash

ashpash
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:09:03 PM

Posted 04 July 2004 - 07:42 PM

Into the network connection

#9 Grinler

Grinler

    Lawrence Abrams


  • Admin
  • 43,400 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:09:03 PM

Posted 04 July 2004 - 11:34 PM

Ok what is the make and model and your adsl modem? It may not be a router in a sense, so will not have a firewall. Also what version of windows are you running.

#10 ashpash

ashpash
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:09:03 PM

Posted 05 July 2004 - 02:29 AM

Running Windows XP Pro and the Modem is NetComm ADSL Modem NB1300 like http://www.netcomm.com.au/ADSL_Modems.php

#11 Grinler

Grinler

    Lawrence Abrams


  • Admin
  • 43,400 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:09:03 PM

Posted 05 July 2004 - 10:56 AM

Ok you do not have a firewall running, nor a router blocking anything.

Do the following:

Click on start, then control panel, and double-click on administrative programs. then double-click on internet information services.

Click the + next to web sites. Right click on default web site and press stop.

Then run the portscan. The port 80 should be closed

#12 ashpash

ashpash
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:09:03 PM

Posted 06 July 2004 - 06:35 PM

I dont have those options in Control Panel I only have Administrator Tools. As far as I know I do not have IIS activated. If I go to Control Panel/Add Remove Programs/Add Remove Windows Components then Internet Information Services is unticked. I need the disk to activate this but I cant find my disk....which is totally normal for me. I have put it in a safe place but cant remember where and have looked everywhere I can think I may have put it. I have been through a house move so its possible its somewhere else entirely.

#13 Grinler

Grinler

    Lawrence Abrams


  • Admin
  • 43,400 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:09:03 PM

Posted 06 July 2004 - 07:34 PM

Download this file:

http://www.bleepingcomputer.com/files/forensics/Fport.exe

Save it to the c:\ drive.

Then click on start, run, and type cmd and press the ok button.

At the cmd prompt, type the following:

cd \ and press enter

fport > fport.txt and press enter.

notepad fport.txt and press enter.

Copy and paste the contents of the notepad to a reply to this message.

#14 ashpash

ashpash
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:09:03 PM

Posted 06 July 2004 - 08:22 PM

FPort v2.0 - TCP/IP Process to Port Mapper
Copyright 2000 by Foundstone, Inc.
http://www.foundstone.com

Pid Process Port Proto Path
908 svchost -> 135 TCP C:\WINDOWS\system32\svchost.exe
4 System -> 445 TCP
952 svchost -> 1025 TCP C:\WINDOWS\System32\svchost.exe
4 System -> 1026 TCP
1428 -> 3001 TCP
952 svchost -> 3002 TCP C:\WINDOWS\System32\svchost.exe
952 svchost -> 3003 TCP C:\WINDOWS\System32\svchost.exe
648 ccApp -> 3006 TCP C:\Program Files\Common Files\Symantec Shared\ccApp.exe
952 svchost -> 3958 TCP C:\WINDOWS\System32\svchost.exe
952 svchost -> 3965 TCP C:\WINDOWS\System32\svchost.exe
928 SpySweeper -> 4972 TCP C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
1128 -> 5000 TCP

1128 -> 123 UDP
908 svchost -> 445 UDP C:\WINDOWS\system32\svchost.exe
4 System -> 500 UDP
1428 -> 1900 UDP
952 svchost -> 3007 UDP C:\WINDOWS\System32\svchost.exe
4 System -> 3010 UDP
952 svchost -> 3017 UDP C:\WINDOWS\System32\svchost.exe
952 svchost -> 3122 UDP C:\WINDOWS\System32\svchost.exe
952 svchost -> 3169 UDP C:\WINDOWS\System32\svchost.exe
952 svchost -> 3668 UDP C:\WINDOWS\System32\svchost.exe
928 SpySweeper -> 4000 UDP C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

#15 Grinler

Grinler

    Lawrence Abrams


  • Admin
  • 43,400 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:09:03 PM

Posted 06 July 2004 - 11:22 PM

Well port 80 is not open on your pc so am not sure what it is seeing. If you want to pm me your ip address tomorrow at some point I will check it out and report to you what is listening on port 80.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users