port listener xp

Don't use it; I don't know why it should need to run as a server. You can get a similar program from System Internals called tcpview that will list your open ports. They also have something called PortMon, but I don't think PortMon works on XP if you have that, anyway.

http://www.sysinternals.com/

Thankyou Rog - I was a bit wary. Perhaps these programmes need to act as servers in order to spoof a port and send a message to the hackers, not sure about this as I'm not an IT genius.
I tried another prog called port block which appears to do the same job. As an experiment I allowed it to act as a server and the port I needed to block - 1524 - appeared in the netstat window as ingreslock and also another port I specified.
That you see is the problem, I have ingreslock connections from time to time and a search on google is alarming.
Something took the bait ip no 160.254.11.223 and this after a search led to something called BLACKHOLE - 1.IANA.ORG special use.
I need to shut port 1524 and maybe one other, and I would also like to know what blackhole is.

You are going to see a lot of probes to various ports, but your firewall should prevent access. If something is "listening" however, it indicates an internal process which may or may not be normal.

Personally I wouln't get too spooked by that kind of thing, but it's good to review the possiblities and see if you can tie it to any programs you have installed. There is a lot of similar discussion in this Google>Groups search, you might want to have a gander:

http://groups.google.com/groups?hl=en&lr=&ie=UTF-8&oe=UTF-8&q=port+1524&sa=N&tab=wg

http://groups.google.com/groups?hl=en&lr=&ie=UTF-8&oe=UTF-8&q=BLACKHOLE+-+1.IANA.ORG&sa=N&tab=wg

Google Groups is a good source to explore both those issues if you haven't used it, but I for one doubt there is anything really abnormal there.

Thanks for the pointers Rog, never heard of google groups, looks like lots of useful info to lighten my darkness.