Results 1 to 9 of 9

Thread: Port 135 (rpc) Open!

  1. #1
    Join Date
    Nov 2001
    Location
    CANADA!
    Posts
    59

    Port 135 (rpc) Open!

    This port is being shown as open at Shields up's port probe even when i have the mode set to "Block Most" and svchost, and alg set to "always block this app".....Is Outpost not detecting some programs?

    Dell P4 1.3
    Windows XP Pro

  2. #2
    Join Date
    Jun 2001
    Location
    Germany
    Posts
    2,143
    Hmm, please delete svchost.exe from your app rules.
    Check in "open ports" if its this svchost.exe listening at this port.
    Enable ruleswiz and scan again. You should be prompted if the grc site wants to make a connection to port 135.

    If this doesnt help:
    Save your configuration (file-save conf or save conf as... always good having a backup).
    Delete EVERY application out of the rules.
    Enable ruleswiz, surf to grc.com and scan again.
    What happens?
    (you get your original conf back with "load configuration")
    and his Eye piercing all shadows looked across the plain to the door that he had made; and the magnitude of his own folly was revealed to him in a blinding flash, and all the devices of his enemies were at last laid bare.

  3. #3
    Join Date
    Nov 2001
    Location
    CANADA!
    Posts
    59
    I deleted svchost.exe from the app list and I tried to scan again. The pop-up window came up and I chose "always block this app". The scan still shows that the port is open. It is svchost.exe that is listening to this port. The port is DCOM which is port 135. What is Remote Procedure Call? I know how to disable it, but I need to know what it does.

  4. #4
    Join Date
    Jun 2001
    Location
    Germany
    Posts
    2,143
    Port 135:
    http://www.outpostfirewall.com/forum...&highlight=rpc

    Basically there is something listening at port 135 and this is allowed to listen. I thought it would be svchost.exe (like in my w2k), obviously not.
    Thats the reason I asked for deleting all apps out of the rules.

    If those port would be still open after deleting, we are running into a bug or something different.
    and his Eye piercing all shadows looked across the plain to the door that he had made; and the magnitude of his own folly was revealed to him in a blinding flash, and all the devices of his enemies were at last laid bare.

  5. #5
    Join Date
    Nov 2001
    Location
    CANADA!
    Posts
    59
    hmmm.....very wierd. I just did the scan again and this port is stelthed. The only thing different is my client computer is turned off........
    Any ideas?

    What is svchost anyways? What does it do and do i need it? I am using internet connection sharing.

  6. #6
    Join Date
    Aug 2001
    Location
    USA
    Posts
    4,144
    SVCHOST.EXE: This is a process that runs a group of services that are run from dll files.. It runs from the registry key, HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost where details of the services running under each instance of svchost.exe can be found. It is not unusual for more than one instance of this programme to be running in Task manager, this is done to optimise the running of the various services.
    This service listens on port 135 and cannot be closed. I have svchost.exe in my blocked applications sections and it always shows stealthed. I am on a stand alone computer with Win2K SP2.
    I believe you can block port 135 even though you are networked.
    If you have this in your blocked applications section and you do not have any other application allowing use of port 135, and you still fail stealth, then there may be a bug.

  7. #7
    Join Date
    Nov 2001
    Location
    CANADA!
    Posts
    59
    Yes I found out that it is svchost that is listening to this port, there are no other programs listening to this port. I restarted my computer and tried what WizzOzz suggested and when I went to scan another pop-up window came up and I chose Block all connections to this app...and the results....

    ALL STEALTH!

    thnx everyone

  8. #8
    Join Date
    Jul 2001
    Location
    Goettingen, Germany
    Posts
    25
    If someone should encounter the same problem with Windows XP running, so may be stated that XP needs the svchost.exe allowed for broadband connections, especially for those using PPPoE. Without svchost.exe allowed, you will not be able to establish any outgoing connection.

    The rule for allowing internet access with keeping port 135 stealth is quite easy:

    "Where the protocol is UDP and where the direction is OUTBOUND and where the host is 239.255.255.250 and where the remote port is 1900 ALLOW it."

    HTH.

  9. #9
    Join Date
    Aug 2001
    Location
    Barcelona - Spain
    Posts
    649
    As a general rule to not get unwanted opened ports: Never set a application as trusted, setup rules for the ports needed.

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Similar Threads

  1. Outpost 4.0.964.6926 in stelth mode leaving port 12345 and port 31337 open (PC-Flank)
    By Ancaria in forum Outpost Pro FIREWALL General Discussions, Support, and Troubleshooting
    Replies: 1
    Last Post: 29 Oct 2006, 06:20
  2. port 139 open/ how to close a port?
    By spunk in forum Outpost Pro FIREWALL General Discussions, Support, and Troubleshooting
    Replies: 1
    Last Post: 30 Mar 2005, 00:50
  3. Port 80 open
    By INET in forum Outpost Pro FIREWALL General Discussions, Support, and Troubleshooting
    Replies: 12
    Last Post: 28 Mar 2005, 12:18
  4. Open Port
    By joeyparrot in forum Outpost Pro FIREWALL General Discussions, Support, and Troubleshooting
    Replies: 7
    Last Post: 31 Dec 2002, 23:48
  5. RPC-Port open?
    By DaF in forum Retired Threads
    Replies: 21
    Last Post: 27 Nov 2001, 02:01

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •