I don't know how to shield under DOS, but I can check the input NETSTAT -A and the open port. The port is IP: the number string after it.

2.

I extracted some words about USB.

If there is no USB device connected to the USB interface, users or groups can directly modify the "Deny" permissions of Usbstor.pnf and Usbstor.inf in the "inf" directory under the system directory. The method is: start the resource manager, find the %SystemRoot%\Inf folder, right-click the Usbstor.pnf file, click Properties-Security, select the user or group for which you want to set the "Deny" permission in the "Group or User Name" list, and then check "Deny" next to "User Name or Group Name Permission-Full Control", which will take effect after confirmation.

Sometimes, in order to facilitate and avoid the complexity of plugging and unplugging, some USB devices may need to be plugged into the USB port for a long time. At this time, we can disable USB devices by modifying the registry, and it is best to back up the registry before operation. Run the command "regedit" and click OK. Find the registry key HKEY _ local _ machine \ system \ current control set \ service \ usbstor, and change the "Start" numerical data on the right to 4 (note that it must be 16), which will take effect after restarting. If there is no way, the value should be 3.

3.

There are other protocol ports under TCP/IP.

You can open or close the ports of FTP, HTTP and other protocols in Control Panel -“windows Firewall-Advanced tab-Network Connection Settings-Settings.