listening ports on windows xp

There is a very handy tool outhere Called Active Ports.
 It enables you to monitor all open TCP and UDP ports on the local computer. Active Ports maps ports to the owning application so you can watch which process has opened which port. It also displays a local and remote IP address for each connection and allows you to terminate the owning process. Active Ports can help you to detect trojans and other malicious programs.

It is a small proggie 475k but very usefull.

http://www.protect-me.com/freeware.html

Hi Sanctify

Those programs are great solving what program has opened ports but I have also used program called LanGuard. Best part of that program is that it gives quite easy to read results. When Languard finds something suspicious it gives human readable information :)

You can find demo from here:

http://www.gfi.com/lannetscan/

Well the best thing you can do is to keep yourself up to date with your Antivirus, and various service pack / patches so that most known security issues are solved.

Next think you should do is to figure out which services you have running that you dont acctually use, go to control panel, administrative tools, services..or just click start -> run -> services.msc <ENTER>

Do you use remote registry? if not and if non of your programs uses it, then disable it.

Try netstat -ano again, look up the PID nr. press CTRL ALT DEL, go to taskmanager, add the PID field.
That way you can see which program uses or listens to which port number

Now you can clerify more accurate which ports you should allow and which you shouldn't.

I suggest using a router to connect to the internet which has somekind of packet filtering, so you can control which packets you want to allow on your LAN and which packets you allow to access the WAN interface. If you want to host services/servers then make sure it has somekind of port forwarding, where you can direct incomming ports to a destination on your LAN.

Also check out Vision.
http://www.foundstone.com/index.htm?subnav=resources/navigation.htm&subcontent=/resources/proddesc/vision.htm

This will show you what process/exe is running the port.

Nathan

There is nothing to worry about here.  These are no security risks.  Most of those ports are just associated with other windows services.  For example, port 1025 is usually associated with windows Messenger Service.  Windows usually opens a range from 1000 - 3000 for use of other services if needed.  I have more then that listening, but none of them are actually the service.  I hope you get what I'm saying.

The one thing that does sort of look suspecious is the high end ports.  Windows does not use any ports that are over 65535 for its general purposes.  So, if there are ports like 130000 etc. then you should be cautions for which it could possibly be a trojan or some sort of keylogger / spyware.