Page 1 of 2 12 LastLast
Results 1 to 10 of 12

Thread: windows.security.firewallopenports detected

  1. #1
    Junior Member
    Join Date
    Sep 2006
    Posts
    6

    Default windows.security.firewallopenports detected

    hi. in my latest scan using spybot s&d (update file 9/22/06) the scan
    detected two problems in the registry, both in:

    windows.security.firewallopenports. and both detected problems are identical as far as location in the registry.

    i am using the MS firewall.

    apparently this is now being scanned by spybot. can someone please explain to me what this is? i've googled this and searched miscrosoft.com but can't seem to find any useful information. is this something to be concerned about or is this some sort of false positive?

    thanks,

    rich

  2. #2
    Member of Team Spybot tashi's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    30,956

    Default

    Hello

    Could you give more information please:

    1) Exact message you receive.
    2) Security programs installed.
    3) Version of Spybot-S&D.

    Please open Spybot>Help>About, it will give you the version and latest detection update information.

    While the Windows XP Firewall is better than nothing at all; it's functions are limited.
    http://www.microsoft.com/windowsxp/u...nfirewall.mspx

    Please see this article for prevention tips and programs.
    So how did I get infected in the first place? By Tony Klein
    Microsoft MVP Reconnect 2018-
    Windows Insider MVP 2016-2018
    Microsoft Consumer Security MVP 2006-2016

  3. #3
    Junior Member
    Join Date
    Sep 2006
    Posts
    6

    Default

    thanks for the response. the info you're seeking is below.

    Hello

    Could you give more information please:

    1) Exact message you receive.


    sure.

    HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List\21:TCP

    both items found by spybot are exactly the same. i am assuming that the above refers to a TCP connection on port 21. with that in mind, i have rebooted into safe mode and re-run spybot. the same two items are found. what i don't understand is if they are a true infection or a false positive.


    2) Security programs installed.

    installed and running are the following:
    - windows firewall
    - spyblaster v3.5.1
    - norton system works 2005 which includes norton A/V
    - counterspy v1.5.82 with definition file 414
    - adsgone 2006 v5.3.3.16

    also used on a periodic basis but not left running are:
    - ad-aware se personal build 1.06r1
    - pest patrol v 12/27/2004 4.4.4.81 with the 9/22/06 database


    3) Version of Spybot-S&D.

    - v1.3 with the 9/22/06 database

    Please open Spybot>Help>About, it will give you the version and latest detection update information.

    While the Windows XP Firewall is better than nothing at all; it's functions are limited.


    i know that. i normally run ZoneAlarm (free edition) but have had some issues with their v6. i am currently researching whether to revert back to
    v5.x or use another product. i'm using the MS firewall in the meantime.


    http://www.microsoft.com/windowsxp/u...nfirewall.mspx

    Please see this article for prevention tips and programs.
    So how did I get infected in the first place? By Tony Klein [/QUOTE]


    thanks, i will.
    i have not allowed spybot to delete the two items. i won't do that until i understand just what they have detected.

    thanks again.

    rich

  4. #4
    Spybot Advisor Team [Retired] md usa spybot fan's Avatar
    Join Date
    Oct 2005
    Posts
    5,859

    Default

    Side note:

    You should consider upgrading to Spybot 1.4.

    Getting an answer is one thing, learning is another.


    Microsoft Windows XP Home Edition running on a 2.40GHz IntelŪ PentiumŪ 4 Processor with 512 MB of RAM and a 533 MHz System Bus.

  5. #5
    Member of Team Spybot tashi's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    30,956

    Default

    Quote Originally Posted by md usa spybot fan View Post

    You should consider upgrading to Spybot 1.4.
    I agree, then after updating to the latest definitions run another scan and let us know the results:





    Microsoft MVP Reconnect 2018-
    Windows Insider MVP 2016-2018
    Microsoft Consumer Security MVP 2006-2016

  6. #6
    Junior Member
    Join Date
    Sep 2006
    Posts
    6

    Default

    ok, but that doesn't answer my initial question which was is this an actual detection or a false positive? and am i correct in interpreting that the 'hit' is indicating that port 21 is open?

    rich

  7. #7
    Junior Member
    Join Date
    Sep 2006
    Posts
    6

    Default

    i phrased that badly. what i'm asking is this. what is spybot detecting? is this windows.security.firewallopenports a setting within windows that i can check? i'm not getting any background info on this via google, a search of microsoft.com or XP help. i realize that you can't tell me if this hit is a false positive but i'm trying to understand what spybot is checking.

    rich

  8. #8
    Junior Member
    Join Date
    Sep 2006
    Posts
    6

    Default

    hi. ok, i downloaded and installed v1.4 of spybot S&D, did a scan and got the same results.

    thanks.

    rich

  9. #9
    Junior Member
    Join Date
    Oct 2005
    Location
    Southern calif
    Posts
    4

    Smile "Replacing" Windows "firewall" !?

    Hi Rich :

    Perhaps the question would become moot if you found a "replacement" for
    the "half-a-firewall" Windows ; I agree on not using ZA. However, there are
    lots of good & FREE ones available; I still use the bought out by Symantec/
    Norton Sygate Personal, available for download from :
    http://www.filehippo.com/download_sy...onal_firewall/ . There is a "Setup
    Guide" @ www.kotiposti.net/string/SPF_eng/SPFGuide.html .
    After installation, should use the "Shields Up" test at www.grc.com .

    In fact, if the "Windows Firewall" is part of the XP SP2 "Security Center",
    should consider "disabling" the entire "Center" based on the info at :
    www.pcmag.com/article2/0,1759,1639276.00.asp !?
    For the BEST in What counts in Life :

    www.tacf.org

  10. #10
    Junior Member
    Join Date
    Sep 2006
    Posts
    6

    Default

    good evening. can you check that pc mag link...it won't come up.

    thanks.

    rich

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •