listening svchost

i already disabled netbios, dcom, task scheduler, create rules to block it,
but it still show listening to port 135, etc.

why was that?

It’s listening due to RPC Endpoint Mapper and Remote Procedure Call. The former should never be disabled. It should only be listening on the loopback interface.

[attachment deleted by admin]