Re: pop3 open?
 

Too add a bit further ot the above.

If you need to establish which port and application is running etc.

Try start/run type in command to get you to a dos window.

Then type - netstat -anon

From that list you will PID Numbers.

Leave the dos window open with the list goto control alt delete and task manager click on processes then the view tab then select columns and place tick in PID.

You can then cross reference from the dos window which PID is using which application.

As mentioned above then you can try eliminating to see if any are causing the port to remain open.

:)

Re: pop3 open?
 

I have Zone Alarm Pro and Spampal. The latter listens on 127.0.0.1 and only accepts connections from 127.0.0.1. Indeed, if it listens on 127.0.0.1 then it's not able to accept connections from the outside. Installing Zone Alarm didn't change any settings nor would I expect it to. Port 110 only has to be open locally and be locally addressable for everything to work. I can't see why any proxy or server would have to globally addressable in order to work correctly - Apache works fine with 127.0.0.1, for example.

The Bat ---> Spampal ---> ZA ---> NTL MTA
NTL MTA ---> ZA ---> Spampal ---> The Bat

A Shields Up port scan gave my system a "perfect "TruStealth" rating" - i.e. no ports are open. If Russ is scanning and can connect to port 110, then the email proxy is globally addressable and I don't see any reason for this other than if you wanted to provide spam filtering for others.

Look at the settings for the software listening on 110 rather than trying to configure ZA to block the port!

:confused:

Re: pop3 open?
 

Tell you what - you show me evidence that a single server anywhere has been hacked into via pop3 on port 110 and I'll believe you. :D

Russ - in a dos box type "netstat -an" - you will get something like below;

Proto Local Address Foreign Address State
TCP 0.0.0.0:135 0.0.0.0:0 LISTENING
TCP 0.0.0.0:445 0.0.0.0:0 LISTENING
TCP 0.0.0.0:1025 0.0.0.0:0 LISTENING
TCP 0.0.0.0:2401 0.0.0.0:0 LISTENING
TCP 0.0.0.0:3709 0.0.0.0:0 LISTENING
TCP 0.0.0.0:3765 0.0.0.0:0 LISTENING
TCP 10.27.2.5:139 0.0.0.0:0 LISTENING
TCP 10.27.2.5:1663 207.46.106.173:1863 ESTABLISHED
TCP 10.27.2.5:2701 0.0.0.0:0 LISTENING
TCP 10.27.2.5:13446 0.0.0.0:0 LISTENING
TCP 127.0.0.1:110 0.0.0.0:0 LISTENING
TCP 127.0.0.1:9090 0.0.0.0:0 LISTENING

Look for the LISTENING entry for Port 110 and tell us if the IP address is 127.0.0.1 (as above).

Re: pop3 open?
 

A quick Google and: http://www.cert.org/advisories/CA-1998-08.html

It might not have been done - we'll never know because very few companies are honest about hacks - but that's a long way from "it can't be done" :D

Re: pop3 open?
 

Anyone know how to configure Zone Alarm Pro for port 110? It's still showing up as open....

Re: pop3 open?
 

Go here https://grc.com/x/ne.dll?bh0bkyd2 and click "Proceed". Then click the "Common ports" button. Is 110 open?

All ports are closed by default in ZAP, unless you give a program server permissions or specify firewall-level expert rules. So lets say I misconfigured spampal to accept requests from any user rather than only my PC, and I gave spampal internet server permission in ZAP, then 110 would show as open when scanned from the Internet.

If you've downloaded a piece of software and are using that to scan for open ports, then it will give false results because ports can be open locally but still be inaccessible from the Internet, which is on the other side of your firewall.

Re: pop3 open?
 

That test, just like every other one I do, tells me port 110 is open....

Re: pop3 open?
 

I just tried telnetting onto port 110 on your ip and got nowhere - maybe the tests are lying, or ZA is protecting you (or maybe your connection is not online atm, I'll try it again tonight when I know you are on).

Re: pop3 open?
 

Well you must have configured your firewall to allow a program to listen on port 110. Just have to either revoke that permission or find the program and make sure it only listens locally.

Re: pop3 open?
 

Need an aspirin yet Russ? I know I do after reading this.

Can't you just work through ZAP program by program?

Re: pop3 open?
 

He could export his ZAP settings - Overview pane... Preferences tab... Click "Backup". Then post the file here for folks to look at. Not sure how else to resolve this problem - need to know what each program does and what permissions have been given. Don't just click "Yes" at every alert :) Once the program is found, he can then block it and/or reconfigure it to listen locally.

Re: pop3 open?
 

I see no 'backup'.....

Is it possible that the problem is being caused by Spam Inspector? That's got permanent permission.

Re: pop3 open?
 

Yes. What permissions does it have? Can you do what I think Pem suggested - netstat /a at the DOS command prompt.

Backup button shown in the attached screenshot. It's a good idea to save your settings just in case something happens :)

Re: pop3 open?
 

I passed on that test!

Re: pop3 open?
 

hmm. Arcording to the test on this page ive failed the test despite all ports been "stealth" :confused: