New PC Default Open Ports

[seag33k]

I just bought a new Lenovo W520. I was testing the Norton Firewall and running port scans against the machine. I noticed some open ports so I did a recovery to factory condition. I ran the port scan again and see a number of ports (25, 80, 110, 8080 - if memory serves correct). I telnet to the ports and they respond but the is no visiable text so it is difficult to figure out what is running. I know what these ports are typically used for, but since it is a factory re-install and I haven't installed any software that would run these services, I am at a loss. I've tried using Tcpview and other tools to view the open ports via Windows 7, but I don't see those ports listening. I am wondering if there are some Lenovo tools/utilities that use these ports? I may just be paranoid

Thanks!

 

[seag33k]

Updated Info!!

I decided to break out the big guns. I ran a Nessus scan and NMAP againts my W520. The same ports weren't open when compared to the scan by Advanced Port Scan by RAdmin. These are the results of nmap which mirror the open ports Nessus found. Keep in mind, I had the firewall turned off since I am testing Bitdefender's Internet Security 2012. I used TCPViiew to link the process to these ports and found:

135
139
443 - VMWare Worksation
445
902 - VMWare Workstation
912 - VMWare Workstation
5357 - svchost.exe
49152 - wininit.exe
49153 - wininit.exe
49154 - wininit.exe
49155 - wininit.exe
49165 - wininit.exe

When I enable the firewall, none of the ports are visable. I am looking at using the BitDefender or Kaspersky's Internet Security Suites. Thoughts from other security folks appreciated!

 

[karlsnooks]

Use Microsoft Security Essentials.

Understanding Microsoft Anti-Malware Software 2012 ~ Security Garden

 

[seag33k]

MS Security Essentials did fair as well according to this:

AV-TEST - The Independent IT-Security Institute: Jan/Feb 2012

 

[karlsnooks]

and actually far better.

Testing of AV software is rather warped.

The proof is in the pudding as the saying goes.

Real life conditions, real life systems put MSE at the top.

Remember, this is the same AV that is installed on a Microsoft Enterprise system, the same AV they use on their systems.

 

[seag33k]

We just deployed Forefront Endpoint Protection via SCCM at work so we'll see how it compares to the other tools we've used in the past. I do like how the suites integrate a Firewall and IDS into one product though.