Are you running a virus scanner, such as Norton AntiVirus? This behavior is often caused by AntiVirus software that scans incoming and outgoing email.
On Tuesday 07 January 2003 06:45 pm, joe wrote: > Hi, im new to security and this is my first post, so be gentle :) > > I have a fairly good understanding of the tcp/ip model and i think i > understand what ports are for! but i cant understand that on my box, i have > the 2 default mail ports (25 and 110) open. Its a windows 2000 box, service > pack three. Im pretty sure im not running a mail server of any description. > > The ports appear in box scanline and superscan eg > > C:\>sl -bht 1-1000 192.168.0.1 > ScanLine (TM) 1.01 > Copyright (c) Foundstone, Inc. 2002 > http://www.foundstone.com > > Scan of 1 IP started at Wed Jan 08 00:36:51 2003 > > --------------------------------------------------------------------------- >- - > 192.168.0.1 > Responded in 0 ms. > 0 hops away > Responds with ICMP unreachable: No > TCP ports: 25 110 135 139 445 > > > --------------------------------------------------------------------------- >- - > > Scan finished at Wed Jan 08 00:37:09 2003 > > 1 IP and 1000 ports scanned in 0 hours 0 mins 18.16 secs > > but in netstat, activeports, fport they dont! does anybody know where they > have come from? i googled for ages but dont seem to be getting anywhere. > > > > thanks > > joe
