Sorry to hear about your troubles. I really don't know how to close those ports, but what you can do is break the file so it can't run. Each file, especially executables, have a header, a piece of information identifying it as a particular type of file. If that is gone, it has lost it's identity. So, break those files. I would make backups, then go into edit.com (in a pure-dos setting, not MS-DOS Prompt), and edit the files. Find them using Windows find, and write down the directories they are in. Next, boot using a EBD (Emergency Boot Disk), or similiar disc, just boot so Windows isn't running at all. Safe mode doesn't count. Now, edit the files. You see the MZ at the beginning at each of them? Turn on overwrite mode by pressing the insert key, and just space over the MZ, and a few more random characters while you are at it. Save that file. Continue on doing this until all of them are edited. It kind of sounds like a trojan, what you have, and those must be loaded. If the file is removed, the trojan will replenish itself somehow, but if it's broken, it can't be run, and since it's not removed, it won't rebuild itself. I hope I'm making sense. Good luck! After all is said and done, I'd get some anti-virus software on your system, just to be on the safe side.