As the NSA recommend, disable Remote Desktop Services and its associated port (TCP 3389). But I'm also not saying don't update. I'm saying choose when you want to update and what you want to update. Use your own firewall and virus software, lock down your own system.

Forgive me for being glib but; Leaving a backdoor for good old papa Gates to protect you is a bad strategy.

I find it very strange that a computer can boot up with some ports open, that's beyond stupid. Nevertheless all my modems have had the default config to block all incoming requests.

Imagine a port open connected to a program with admin priviles which sole purpose is to give people full access to your computer and your desktop. Hidden in plain sight, maybe?