I had a few ports open through exceptions created in the Windows
Firewall control panel. I'm quite sure these were added pre service
pack 2. I no longer use the program for which these ports were opened
so I deleted them through the Windows Firewall control panel
(definitely post service pack 2). The ports were added as exceptions,
not the program. The exceptions no longer appear in the Windows
Firewall control panel, and they do not exist in the registry. The
computer has been rebooted. However, when using the command

netsh firewall show state verbose = enable

or

netsh firewall show config verbose = enable

it still shows that these ports are open (enabled) and uses the same
names to identify them as I used when I created them through the
Windows Firewall control panel. Where is this information being
saved, and how can I get rid of it? I tried installing the new
control panel as suggested by KB897663, but the exceptions still do
not show up in the Windows Firewall control panel, only with netsh.

I finally found where the settings were hiding. They aren't found on
the Exceptions tab, but on the Advanced Tab using the Settings button
under Network Connection Settings. I guess this is local vs. global
settings. I don't remember if this is new to service pack 2. If the
same port is in both places however, just deleting it from one won't
close the port.