[Full-Disclosure] ICF scan

[isa vaul]

Hi list,

This might not be the right place for it, but I thought maybe some of you 
guys had an explanation for the following. I was playing around with my XP 
box and scanned myself with the ICF in place and without.

ICF-scan:

* + 127.0.0.1
             |___   135  DCE endpoint resolution
             |___   389  Lightweight Directory Access Protocol
             |___  1720  h323hostcall
             |___  3001  Redwood Broker
             |___  3002  EXLM Agent

without:

* + 127.0.0.1
             |___   135  DCE endpoint resolution

So as I understand the functionality of ICF (default adjustments) it should 
prevent every connection towards my computer unless the connection has been 
established by a process on my side (ACK, SYN/ACK). But why there are more 
open ports with ICF than without?

Thanks for any suggestions in advance.

Kind Regards
Nonleft