Ever since we upgraded one of our home windows machines to Windows 10, Kaspersky has been logging blocked network intrusion attempts over port 8080. The exploit is a strange one and tries to hit a vulnerability that the machine doesn't have. Confused, I ran an nmap version scan on the local address of the machine in question. Sure enough, (at least locally) it is listening on port 8080 (http) with this service: Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP).
I recently disabled UPnP in the router's settings out of security fears. The actual program running on the machine that is tied to that port is...well...the system itself (PID 4). If we weren't getting network intrusion attempts I'd think nothing of it, but obviously, something is being forwarded to the public internet for this to happen. How can I fix this?