08-15-04 10:52 PM
"Richard" <whyshouldi@hetnet.nl> wrote in message
news:cfn9n4$mnj$1@reader10.wxs.nl...
> Hello,
>
> From the Shields Up test at www.grc.com I have learned that my computer
> has
> an open port 80 and 554. An open port 80 means that my computer acts as a
> server and is therefore vulnerable. What is the function of port 554?
>
> I have installed ZoneAlarm (free), security settings high, in the tab
> "Program Control" server functions of all programs disabled. Norton
> Antivirus 2004 doesn't detects anything wrong (but has in the past blocked
> Adware.Iefeats and a dialer). Ad-aware SE from Lavasoft does not detect
> any
> spyware. As far as I know I don't share printers in a network.
>
> If I'm not mistaken port 80 should be open for outgoing traffic (otherwise
> I
> wouldn't be able to surf on the internet). Correct me if I'm wrong, but
> port
> 80 should be closed for incoming traffic. I don't want to run a server or
> open my computer for hack attempts.
>
> Does anybody know how to close port 80 or find out which program or
> anything
> else is keeping port 80 and 554 open? Why is this question asked so often,
> isn't there a site which deals with the problems of port 80 in some depth.
> The answers I find on the internet don't go much further than "you should
> try to find which program/virus/service is keeping port 80 open". Yes, but
> how? Aren't there sites which offer more concrete advice?
>
TCP port 80 is commonly associated with hosting a webserver via HTTP.
TCP port 554 is commonly associated with receiving audio/video using
RealOne, RealPlayer and QuickTime via RTSP.
If your PC is connected by using PPPoeE and a cable modem you will want to
examine your PC for open ports. If however your PC is connected by means of
a DSL router which in turn connects to the cable modem, then you will want
to check both your PC and the DSL router itself for open ports.
To check your Windows XP (SP2) system for open (listening) ports, click
Start | Run, type the following line and press Enter.
cmd /c NETSTAT -ABNOP TCP >c:\netstat.txt
To review the results open the 'c:\netstat.txt' file with Notepad. Next
look at what's under the LOCAL column for an instance of ":80". If you see
such an entry the REMOTE column for that specific row will no doubt indicate
LISTENING. This means that the PC is either hosting a webserver *or* the PC
is hosting something else (probably a trojan) on TCP port 80. To determine
which is it look at the executable name in brackets.
For myself I am hosting a webserver and so the results of running NETSTAT
reflect:
TCP 0.0.0.0:80 0.0.0.0:0 LISTENING 1228
[inetinfo.exe]
To check your DSL router look at its configuration and ensure that the
ability to administer it is not being allowed to the WAN (Internet) side.
If I remember correctly I believe LinkSys DSL routers specifically refer to
this as allowing 'Remote Administration'.
Best of luck...
--
Best regards, from Don Kelloway of Commodon Communications
Visit http://www.commodon.com to learn about the "Threats to Your Security
on the Internet".
[ Post a follow-up to this message ]
| 
