common port scan?

elcid123 · Trooper Joined: Mar 02, 2004 Posts: 15 Location: UK

Starting Common Services TCP Port Scan ...
Connection Refused: Port 21 used by FTP.
Connection Refused: Port 22 used by SSH / secure shell.
Connection Refused: Port 23 used by Telnet.
Connection Refused: Port 25 used by SMTP / send mail / outgoing mail.
Connection Refused: Port 53 used by DNS.
Connection Refused: Port 69 used by TFTP / Trivial file transfer.
Connection Refused: Port 70 used by GOPHER.
Connection Refused: Port 79 used by FINGER.
Connection Refused: Port 80 used by HTTP / web servers.
Connection Refused: Port 110 used by POP3 / incoming mail.
Connection Refused: Port 111 used by SUNRPC / Sun portmapper.
Connection Refused: Port 135 used by EPMAP / Microsoft RPC - SMB file/print sharing.
Connection Refused: Port 137 used by NETBIOS-NS / NETBIOS Name Service.
Connection Refused: Port 138 used by NETBIOS-DGM / NETBIOS Datagram Service.
Connection Refused: Port 139 used by NETBIOS-SSN / NETBIOS Session Service.
Connection Refused: Port 143 used by IMAP / incoming mail.
Connection Refused: Port 194 used by IRC / Internet relay chat.
Connection Refused: Port 389 used by LDAP / lightweight directory access protocol.
Connection Refused: Port 407 used by TIMBUKTU.
Connection Refused: Port 443 used by HTTPS / secure HTTP (SSL).
Connection Refused: Port 445 used by MICROSOFT-DS / directory service, found on Win2k.
Connection Refused: Port 515 used by PRINTER / print spooler.
Connection Refused: Port 525 used by TIMED / time server.
Connection Refused: Port 546 used by DHCP Client.
Connection Refused: Port 547 used by DHCP Server.
Connection Refused: Port 554 used by RTSP / real time streaming (music).
Connection Refused: Port 1080 used by SOCKS / Internet proxy.
ESTABLISHED CONNECTION: Possible Kazaa service found on port 1214.
Connection Refused: Port 1433 used by MS-SQL / MSDE and SQL Server.
Connection Refused: Port 1723 used by PPTP / virtual private network (VPN).
Connection Refused: Port 1863 used by MSN Messenger.
Connection Refused: Port 5000 used by Microsoft UPnP.
Connection Refused: Port 5190 used by AOL Instant Messenger.
Connection Refused: Port 5631 used by pcAnywhere.
Connection Refused: Port 5678 used by Linksys Remote Administration 1.42.7 Vulnerability.
ESTABLISHED CONNECTION: Possible Gnutella service found on port 6346.
Connection Refused: Port 6347 used by Gnutella.
Connection Refused: Port 6665 used by IRCU / common IRC.
Connection Refused: Port 6666 used by IRCU / common IRC.
Connection Refused: Port 6667 used by IRCU / common IRC.
Connection Refused: Port 6668 used by IRCU / common IRC.
Connection Refused: Port 6669 used by IRCU / common IRC.
Connection Refused: Port 8080 used by HTTP-ALT / alternate HTTP (see port 80).
2 possible services were detected on your system. For further help, please visit the CCSP Toolkit Forum

What do I do to close the 2? I am using zonealarm pro, he must current version also finjan sandbox

CCSP Common Services TCP Port

Paul · Admin Joined: Feb 22, 2002 Posts: 5719 Location: USA

That's odd if you are using ZAP that those two ports would be open. Check your list of programs to see what is allowed server access.

elcid123 · Trooper Joined: Mar 02, 2004 Posts: 15 Location: UK

I uninstalled zonealarm pro and reinstalled it freshly so that it removed all my preconficered program assecces and I am still getting the same result?
I will now try blocking assece to a program I have installed called mailwasher pro! I can't understand how the packets are now being let throug

Paul · Admin Joined: Feb 22, 2002 Posts: 5719 Location: USA

No I cannot see MWPro doing that.
Go here:

http://computercops.biz/modules.php?name=Reveal_IP

Is that correct?

elcid123 · Trooper Joined: Mar 02, 2004 Posts: 15 Location: UK

Yes that IP address is corect

Paul · Admin Joined: Feb 22, 2002 Posts: 5719 Location: USA

Can you supply an 'nslookup -an'?

elcid123 · Trooper Joined: Mar 02, 2004 Posts: 15 Location: UK

'nslookup -an'? I'm sorry but I don't understand what this is? can you explain

Paul · Admin Joined: Feb 22, 2002 Posts: 5719 Location: USA

My mistake, I meant to say 'netstat -an'. It'll show you what ports are open and connections established.

elcid123 · Trooper Joined: Mar 02, 2004 Posts: 15 Location: UK

I v still not heard of a netstat-an where do I find it and the information on open ports and established connections in my firewall or elsewhere in my PC settings.
I really am concerned about these two ports being vulnerable and exposed and really appreciate your help in helping me to find the cause.
I can only hope that with your help I can identify the open ports and the cause

Steve

Paul · Admin Joined: Feb 22, 2002 Posts: 5719 Location: USA

Hi Steve, netstat is an executable (binary) program you can from the command prompt (DOS).

This means you have to open a DOS window:

Start | Run | command

Then type in 'netstat -an'.

elcid123 · Trooper Joined: Mar 02, 2004 Posts: 15 Location: UK

Hello Paul this is what I found Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\STEVE>netstat-an
'netstat-an' is not recognized as an internal or external command,
operable program or batch file.

C:\Documents and Settings\STEVE>netstat -an

Active Connections

Proto Local Address Foreign Address State
TCP 0.0.0.0:135 0.0.0.0:0 LISTENING
TCP 0.0.0.0:445 0.0.0.0:0 LISTENING
TCP 0.0.0.0:1025 0.0.0.0:0 LISTENING
TCP 0.0.0.0:1026 0.0.0.0:0 LISTENING
TCP 0.0.0.0:1027 0.0.0.0:0 LISTENING
TCP 0.0.0.0:1040 0.0.0.0:0 LISTENING
TCP 0.0.0.0:1041 0.0.0.0:0 LISTENING
TCP 0.0.0.0:1043 0.0.0.0:0 LISTENING
TCP 80.5.11.197:139 0.0.0.0:0 LISTENING
TCP 127.0.0.1:5101 0.0.0.0:0 LISTENING
UDP 0.0.0.0:445 *:*
UDP 0.0.0.0:500 *:*
UDP 0.0.0.0:1029 *:*
UDP 0.0.0.0:1081 *:*
UDP 80.5.11.197:123 *:*
UDP 80.5.11.197:137 *:*
UDP 80.5.11.197:138 *:*
UDP 127.0.0.1:123 *:*
UDP 127.0.0.1:1082 *:*

C:\Documents and Settings\STEVE>
Now its where do we go from here

Steve

Paul · Admin Joined: Feb 22, 2002 Posts: 5719 Location: USA

Something isn't right... are you going thru a NAT router?

elcid123 · Trooper Joined: Mar 02, 2004 Posts: 15 Location: UK

Hello Paul, I don't understand what a NAT router is? but here is my config info: Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\STEVE>ipconfig

Windows IP Configuration

Ethernet adapter Local Area Connection 2:

C:\Documents and Settings\STEVE>

Paul · Admin Joined: Feb 22, 2002 Posts: 5719 Location: USA

How are you connecting to the Internet? Thru a broadband modem? (You may want to edit out your IP so others won't see it above)

Do you have a device like Linksys or Netgear between your modem and your PC?

elcid123 · Trooper Joined: Mar 02, 2004 Posts: 15 Location: UK

I am not conected thru a router of any kind, I am connected directly to the internet through a cable modem.
I have just spoken to my ISP teck support to confirm this, so what else we can look into?

Steve


	Home ˇ Topics ˇ Submit News ˇ Top 10 This entire site, Cops Themes, and Computer Cops are Š 2002 - 2004 Computer Cops, LLC. All rights reserved. You can syndicate our news using the file RSS 0.91, ultramode.txt, or RSS 1.0. Acceptable Use Policy. Use signifies your agreement. Engine Copyright Š 2002 by PHP-Nuke, GNU/GPL Licensed. ICRA Member. Paul Laudanski, Member of Computer Cops, LLC Server Load: 1112 pages served in previous 5 minutes. Page Rendered: 0.472 seconds.