gregfromaldieva

Q: localhost open ports 9999, 631

while doing a host scan, via Network Utility, I have decided to do a scan of the localhost (127.0.0.1) and discovered the following ports open.

 

I am interested in a way to close the ports 631 and port 9999

 

does anyone know why the following ports are listening and best way forward.

 

http://www.speedguide.net/port.php?port=9999

 

https://isc.sans.edu/port.html?port=9999

 

the links above state the port can be used by trojans

 

Port Scanning host: 127.0.0.1

 

  Open TCP Port: 631    ipp

  Open TCP Port: 1110   nfsd-status

  Open TCP Port: 9999   distinct

 

Port Scan has completed…

 

 

Thank you

iMac (27-inch, Late 2013), OS X Yosemite (10.10.3)

Posted on Jun 13, 2015 7:50 AM

Close

Q: localhost open ports 9999, 631

  • All replies
  • Helpful answers

  • by Linc Davis,Helpful

    Linc Davis Linc Davis Jun 13, 2015 10:18 AM in response to gregfromaldieva
    Level 10 (207,963 points)
    Applications
    Jun 13, 2015 10:18 AM in response to gregfromaldieva

    Port 631 is Printer Sharing. As for the other one, see below.

    This procedure is a diagnostic test. It makes no changes to your data. The instructions must be carried out as an administrator. If you have only one user account, you are the administrator.

    Please triple-click anywhere in the line below on this page to select it:

    sudo lsof -i4:9999 | pbcopy

    Copy the selected text to the Clipboard by pressing the key combination command-C.

    Launch the built-in Terminal application in any of the following ways:

    ☞ Enter the first few letters of its name into a Spotlight search. Select it in the results (it should be at the top.)

    ☞ In the Finder, select Go Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.

    ☞ Open LaunchPad and start typing the name.

    Paste into the Terminal window by pressing the key combination command-V. I've tested these instructions only with the Safari web browser. If you use another browser, you may have to press the return key after pasting. You'll be prompted for your login password. Nothing will be displayed when you type it. Type carefully and then press return. If you don’t have a login password, you’ll need to set one before you can run the command. You may get a one-time warning to be careful. Confirm. You don't need to post the warning.

    If you see a message that your username "is not in the sudoers file," then you're not logged in as an administrator. Log in as one and start over.

    Wait for a new line ending in a dollar sign ($) to appear below what you entered.

    The output of the command will be automatically copied to the Clipboard. If the command produced no output, the Clipboard will be empty. Paste into a reply to this message.

    The Terminal window doesn't show the output. Please don't copy anything from there.

  • by gregfromaldieva,

    gregfromaldieva gregfromaldieva Jun 19, 2015 7:29 PM in response to Linc Davis
    Level 1 (0 points)
    Jun 19, 2015 7:29 PM in response to Linc Davis

    It turned out KAV - KasperskyAntiVirus is what creates the 1110 and 9999 (two) ports on the loopback interface.

     

    Thank you for the quick reply and the how-to very helpful information.

     

    I will leave those ports alone for know, but the procedure did prove useful.

  • by Eric Root,

    Eric Root Eric Root Jun 20, 2015 2:20 PM in response to gregfromaldieva
    Level 9 (71,165 points)
    iTunes
    Jun 20, 2015 2:20 PM in response to gregfromaldieva

    You might want to consider uninstalling Kaspersky as it can interfere wit your computer operation. At this time Mac anti-virus programs aren't required.

     

    Kapersky Uninstall


    If you want an anti-virus program, try ClamXav.


    ClamXav