TCP Port 1025 open?

[NEVER85]

I ran a firewall test, and it warned me that TCP Port 1025 is open for whatever reason. I checked my firewall settings, I can't see why it would be open. I ran virus/spyware scans, and came up with nothing. Anyone have any ideas? My firewall is Sygate Personal Pro if that helps.

[Renshaw]

disable this service if not used..

"Microsoft Remote Procedure Call (RPC) service"

That serice users that port.

[NEVER85]

  Renshaw said:

disable this service if not used..

"Microsoft Remote Procedure Call (RPC) service"

That serice users that port.

Um, isn't that service critical for Windows to run?

[Renshaw]

yeah just looked in to it...

You need it.

http://www.theeldergeek.com/remote_procedure_call_(rpc).htm

[NEVER85]

Also, one of my svchost.exe processes is using more memory than usual. It peaks at around 85,000K, when I've never had it go above 40,000. I dunno if it's somehow related, but I figured I'd throw out that bit of info.

[Pink Floyd Veteran]

one of the svchost is use for theme if I remember correctly. and most of them is there for multiple purpose

[toadeater]

  Pink Floyd said:

one of the svchost is use for theme if I remember correctly. and most of them is there for multiple purpose

Open the command prompt and type "tasklist /svc" and it will show you what's running inside svchost.

[NEVER85]

Well, I disabled all the non-essential services running under that svchost.exe, including themes, but mem usage only dropped by about 3 MB. Anyways, the svchost problem is secondary. What I really want to know is why port 1025 is open instead of being stealthed by Sygate. I googled it and came up with nothing helpful. I'm at a loss here. I'm half-tempted to go back to Windows Firewall.

[John Veteran]

  Renshaw said:

disable this service if not used..

"Microsoft Remote Procedure Call (RPC) service"

That serice users that port.

RPC should never be disabled; it is critical to Windows booting up.

Edit: It seems RPC does use that port, but I can't pinpoint what for.

Edited March 14, 2006 by John

[AndyMutz]

http://www.grc.com/port_1025.htm

[NEVER85]

  AndyMutz said:

http://www.grc.com/port_1025.htm

Thanks, but I've read that already, and tweaking Sygate hasn't helped.

Also, I'm still at a loss about svchost. :no:

[John Veteran]

Svchost.exe is the host used by Remote Procedure Call. RPC is using the port, which explains why svchost.exe shows up in your firewall.

[SunnyB]

Port 1025 can be used by any number of services.

Task scheduler is one example. If you are running

a fax app like Winfax then the NDISWan or NDISTapi

services will open the first available port above 1023

listening for telephony traffic. This is usually port 1025.

The following is a really good site that I have used for

years. It explains what ports are opened by which

applications and how to close them.

http://www.hsc.fr/ressources/breves/min_srv_res_win.en.html

[NEVER85]

Well, I decided to ditch my AV/Firewall software for my copy of Norton Internet Security 2006 that I had lying around. Amazingly enough, everything seems to have been fixed. The svchost.exe that was peaking at 80,000K mem usage is back down to around 45,000, and port 1025 is stealthed. Ironic how Norton actually solved my problems instead of making them worse.

[Lemonzest]

what you need to do is set up a rule for lsass.exe to only use localhost (or 127.0.0.1) and block it outbound. that should stealth it. that one bugged me for a few days.