Windows 7: how to close ports? (not just block them)

Hello,

I am running windows 7 ultimate x64



after booting the pc and without visiting any website when I scan my machine localhost using command nmap -sT -O localhost

it shows the following open ports

135/tcp open msrpc
445/tcp open microsof
1025/tcp open NFS-or-I
1026/tcp open LSA-or-n
1027/tcp open IIS
1028/tcp open unknown
1029/tcp open ms-lsa
5357/tcp open wsdapi
6646/tcp open unknown

no big deal because these are all blocked to the internet with mcafee firewall but still I would like to close them for ever!

I understand 135 and 445 are usually open and I dont mind that but how about the other ports? how can I permanently close them? not just block them with the firewall?

strange thing is I see port 1027 says its IIS (internet information services) but IIS is disabled.


Thanks
7

Typically, you do not want to close ports without knowing exactly what they do to your system. Also, closing them for good might cause issues with your setup somewhere down the line. Google those programs / ports and see what they do for your system. Otherwise, I would just leave them be.

Perhaps, this will be of use:

http://www.iana.org/assignments/port-numbers

sussed them out with net-stat

looks like some are Trojans

TCP 0.0.0.0 135 N/A N/A LISTEN svchost.exe 832

TCP 0.0.0.0 445 N/A N/A LISTEN System 4

TCP 0.0.0.0 1025 N/A N/A LISTEN wininit.exe 532

TCP 0.0.0.0 1026 N/A N/A LISTEN svchost.exe 184

TCP 0.0.0.0 1027 N/A N/A LISTEN svchost.exe 412

TCP 0.0.0.0 1028 N/A N/A LISTEN lsass.exe 636

TCP 0.0.0.0 1029 N/A N/A LISTEN services.exe 584

TCP 0.0.0.0 5357 N/A N/A LISTEN System 4

TCP 0.0.0.0 6646 N/A N/A LISTEN McSvHost.exe 1564

You are running netstat on the local machine. What's more important here is ACTIVE CONNECTIONS (established). If you want to get a more realistic idea of how secure you are, run a port-scanner from the internet. Just because your PC is listening on a port, doesn't mean there's any way possible for something outside your LAN to get wind of that and establish a session. If you have a typical SOHO router, NAT prevents that, unless you circumvent it.

yes they all appear closed from a remote scan, they only show open in localhost. just wondered how to close these ports permanently? except 135 and 445

your request is essentially filled. it doesn't matter if they are open or not. you will not be able to close them without digging around in some places where inexperienced users should not go.

if you have and use a router, it automatically filters out those ports. they are not open to the outside world.