PDA

View Full Version : Windows Services Detected

EV700
August 19th, 2007, 10:51 AM
I ran a tool called SuperScan 4.0 on my external IP address and it was able to retrieve a list of my Windows XP services and their current running states. How can this be prevented?
Gen
August 19th, 2007, 11:04 AM
Do you have any kind of Firewall ?
EV700
August 19th, 2007, 11:06 AM
Yeah, that scan was on my external IP so it should have hit my router.. I can't imagine how it could have went through my router... then it'd had to go through Comodo. But, it happened... because it sure did list my services.

Isn't there something I can disable to prevent that, even if I didn't have a firewall?
Kerodo
August 19th, 2007, 11:42 AM
Something seems rather fishy to me.. ;)
Stem
August 19th, 2007, 11:55 AM
-{ Quote: "I ran a tool called SuperScan 4.0 on my external IP address and it was able to retrieve a list of my Windows XP services and their current running states. How can this be prevented?" }-Can you confirm that you used an external PC to make the scans (outside of the router/LAN). If you made the scans using your PC against your own external (router IP) then the results will be unpredictable.

{Superscan is really quite old, and performs simple ICMP for host detection, and then mainly uses UDP against service ports for ICMP replies.}
Gen
August 19th, 2007, 01:02 PM
Yes as Stem said, check if the scan was done by an external pc then report back.

If it is the case, then something is not right. Could be a wrongly configured firewall, trojan opening specific ports, application that might open those ports etc etc
EV700
August 19th, 2007, 01:45 PM
I did it from my LAN using the external IP address of my router/modem.
Gen
August 19th, 2007, 01:52 PM
This might be the cause then.
If you have access to an external pc not part of your LAN/router etc, it would be interesting to do the scan again and see if you can still see the services running.
Stem
August 19th, 2007, 08:21 PM
-{ Quote: "I did it from my LAN using the external IP address of my router/modem." }-It will not give correct results with this method. (your firewall/router will allow the outbound then can allow the replies to a scan)

You would either have to use a second PC on the LAN and scan the internal (LAN) IP of the PC, or use a PC outside of the LAN/router to scan your WAN IP.