Port 1025 help....

[SRF01]

My buddy needs some help... He posted this on another forum but didn't get a reply. So I told him you guys would probably help out.
It's a win2000 system on cable. Port 1025 is open and listening.

What does this do ??? it is the only port that I've scanned on my girlfriends machine that is listening.. the rest are close (thanks to LooknStop) but I can't seem to get this one to close
?

Her provider is giving her a hard time after she was hacked (of which they don't care) and stating that if they see ANY listening ports her account will be revoked ???

Is there any way to lock down this final port ??? what have I missed ... I set up a rule that deny'd all TCP connections to that port period.. but it didn't seem to make any difference ??

Can anyone shed some light on this subject.. and if it needs to be open.. some reputable docuementation that I can take to her provider and show them. ??

Thanks in Advance for any help you can give

[greEd]

don't worry about it.

source: www.networkice.com
This is the first dynamically assigned port. Therefore, virtually any program that requests a port can be assigned one at this address.

[Juggernaut]

you must also remember that firewalls do not close down ports, they just block access to them.

So u mentioned that u set up a rule to block connections to this port...if someone scanned or tried to connect to it, they would be blocked but the port is still open on u'r side. The firewall just stops access to it.

[DaveLewis]

Hey Guys, It's me the "Buddy"

The Listening condition is shown by a nmap port
scanner on another machine.. actually on another ip.. so it's not an internal only thing.. The web does see it as a listening port. If I do a normal nmap scan it shows that the host is down but if I add a -P0 scan it shows that 1025 is listening, apperently -P0 is used when dealing with microsoft OS's , and because of being hacked they are giving her a hard time about having ANY Listening ports..

This is stupid but to get a connection with out a ppp0E connection is almost impossible and I can't stand pppoE. so that leaves me where I am now, with @Crap. :)

[W_I_Z_K_I_D]

Hi There Buddy..LoL..
Look i once was suspicious about port 1025 until greed came along and said what he said to you..it is the first dynamically assigned port...
asfor shuting it down i got your answer...
try anolgx port blocker...
when you install it click on add and add port 1025 tcp/ip/udp all conections...
tell me if it does the trick

http://www.analogx.com/contents/download/network/pblock.htm

[Boston_Bob]

Hey,

I seem to remember something about a Win2000 built in security module that uses port 1025....It binds to the port at boot time so natually t gets the first available port. Can't remember where i read that though, might just be me losing my mind again....I'll see if I can find it and get back to you. Can't remember why it does that but that may be why you are having such a hard time blocking it.

[DaveLewis]

It's me.. the "buddy" again :)

That would be great.. I'm of the same feeling you are... something to do with Win2000 grabbing the port before the firewall can be put in place..
but I haven't been able to nail down what's doing it... or how to stop it :)