Kerio Rules

Most of the services I don't want to start I set to Manual. I like this better than disable for some because this will allow them to start if another service calls upon them. Unless it is something I considered insecure, I believe setting to Manual is good enough.

There were only a couple that I set to Disable because I really wanted them off, and a Manual setting didn't prevent them from starting (because some other process was triggering them). For myself, I don't need the DHCP Client (I'm on an ADSL PPPoE connection that doesn't use DHCP), and Manual wouldn't prevent it from starting, so I set it to Disable.

I also set "Automatic Updates" to Disable (because I really wanted that one dead! ), plus a couple that aren't on Windows 2000 but are included on XP.

Manual should be fine unless you are worried about a particular service. Your list of Services looks really clean!

Oh, and of course, everytime I've done a major update at Windows Update, Microsoft re-enables and restarts Automatic Updates.

 

Some people do run okay with port 135 closed, but many don't. I wouldn't close it (and I didn't, as noted in the other thread I referenced in a previous post).

As far as port 31337, just bring up a DOS/CMD window and run a "netstat -an" command to see if anything is actually listening on that port. If nothing is listening, than the scanning site is either wrong or your ISP could be intercepting that port for something purpose, before it reaches your machine. In any case, if nothing is listening, you have nothing to worry about. If it is open on your system, then it becomes a matter of tracking it to the program holding the port open and proceeding from there.

 

Could be any number of things, as you saw from your Kerio active connections screen, (same data - just presented differently)... Different programs holding open connections for different purposes.

In the screen shots below, you see the execution of a netstat command, twice. The first one was immediately after I used IE to connect to two different websites (fairly verbose ones - with lots of images, ads, etc.) The second netstat command was a minute or so later. I hadn't done anything, just waited. The excess connections closed in the amount of time that passed between the two netstat commands. I wouldn't worry about ports opened by IE while browsing.

If I'm also at a port scanning website at the same time I'm doing other browsing, these IE ports won't appear to be open to the scanner because they are busy in the established connections to the other sites.