0
I recently did a fresh install of Windows on a formatted disk, upgrading from Windows 7 Pro to 8.1 Pro. Now I have installed a few things already, including:
- Embarcadero RAD Studio XE8
- Microsoft Visual Studio 2015
- Microsoft Office 2013
- Microsoft SQL Server 2008 R2
- IObit Advanced System Care & related tools
I remotely did a TCP port scan of this computer, not only scanning for just opened ports, but actually listening ports. Here are the results:
OPEN: 25 SMTP
OPEN: 80 HTTP
OPEN: 110 POP3
OPEN: 119 NNTP (Network News Transfer Protocol)
OPEN: 135 DCE or EPMAP
OPEN: 139 NetBIOS Session Service
OPEN: 143 IMAP
OPEN: 443 HTTP over TLS/SSL (HTTPS)
OPEN: 445 Microsoft-DS SMB File Sharing
OPEN: 465 SMTP over TLS/SSL (SMTPS)
OPEN: 563 NNTP over TLS/SSL (NNTPS)
OPEN: 587 Email message submission (SMTP)
OPEN: 993 IMAP over TLS/SSL (IMAPS)
OPEN: 995 POP3 over TLS/SSL (POP3S)
OPEN: 2179 VMConnect to Hyper-V hosts
OPEN: 3389 RDP (Remote Desktop)
OPEN: 5357 Web Service for Devices (WSDAPI)
OPEN: 18864
OPEN: 49156
OPEN: 49157
I'm concerned in particular about all the email related ports which are listening (SMTP, POP3, etc.), as if my computer is running an email server. I can't imagine any reason why Windows or any of the above software would need to listen on these ports. I'm also always extremely careful what I install, avoiding any kind of malware and only installing things which are approved by the company.
Why is my computer listening on these email related ports? Is this something which is a standard part of Windows and/or the above software? Or am I looking at potential malware already on my machine?
PS - I wrote this port scanner myself (so that I can trust the results) which consists of a TCP Client actually successfully connecting to each of these ports with a 150ms timeout. I ran it from another computer.
Jerry Dodge
Posted 2015-07-26T18:06:03.600
Reputation: 351
Are you running outlook as part of office? – DavidPostill – 2015-07-26T18:19:49.763
1@DavidPostill Outlook is a client, not a server. Even with Outlook running this can't happen. – Tonny – 2015-07-26T18:20:37.833
Are you sure the scanning tool isn't giving bogus results ? This looks as if it reports the contents of a standard services file in stead of doing a real, proper scan. How did you perform the scan ? – Tonny – 2015-07-26T18:22:23.430
I wrote the scanner myself actually, it actually successfully connects to each and every one of those ports, in this particular case with a 150ms timeout. I ran it from another computer. – Jerry Dodge – 2015-07-26T18:29:32.810
I also manually typed in the descriptions of each, the first 3 don't have descriptions only because I didn't start adding descriptions until the 4th. – Jerry Dodge – 2015-07-26T18:34:33.020
what's the result of tcpview? you can at least find which process is listening on the ports.
– Chris.C – 2015-07-26T18:44:38.727Try a scan using ShieldsUp
– DavidPostill – 2015-07-26T18:46:28.447Whatever it was, it's not listening now, doing some trial/error with various software. – Jerry Dodge – 2015-07-26T19:28:46.130
In a future IMHO better to use standard OS's tools. Run
netstat -anboas administrator and check not only listening port, but you will find what exact program opened it. – Alex – 2015-07-26T19:36:06.423Yeah, at the time of the scan I was busy with other things, tried a few scenarios out but can't get these ports to show up again in any scan. – Jerry Dodge – 2015-07-26T20:21:05.703
I'm voting to close this question as off-topic because issue has gone away and is not reproducible so question is not useful for others. – DavidPostill – 2015-07-27T07:32:04.697