Saturday, July 10, 2010

♦ Dangerous Port 139 NetBIOS

hat is Port 139 ?
           Port 139 as netbios protocal,Windows make this port for many purpose where easy to using such as file sharing on network, printing via network. Surely worms or viruses which can use this open port to make your computer slow and damage. we recommend you close this port if you did not use its.

Check your self ?
          c:\windows> netstat -an | find /i "139"   
              TCP 192.168.0.8:139           0.0.0.0:0              LISTENING
          Solution: see 192.168.0.8 , this is your IP Address and follow with 139 , 139 mean netbios protocal where shown you that this port is opened.

           c:\windows> netstat -an
Active Connections

  Proto  Local Address          Foreign Address        State
  TCP    0.0.0.0:80             0.0.0.0:0              LISTENING
  TCP    0.0.0.0:135            0.0.0.0:0              LISTENING
  TCP    0.0.0.0:445            0.0.0.0:0              LISTENING
  TCP    0.0.0.0:554            0.0.0.0:0              LISTENING
  TCP    0.0.0.0:2869           0.0.0.0:0              LISTENING
  TCP    0.0.0.0:3306           0.0.0.0:0              LISTENING
  TCP    0.0.0.0:5357           0.0.0.0:0              LISTENING
  TCP    0.0.0.0:10243          0.0.0.0:0              LISTENING
  TCP    0.0.0.0:49152          0.0.0.0:0              LISTENING
  TCP    0.0.0.0:49153          0.0.0.0:0              LISTENING
  TCP    0.0.0.0:49157          0.0.0.0:0              LISTENING
  TCP    0.0.0.0:49158          0.0.0.0:0              LISTENING
  TCP    0.0.0.0:49159          0.0.0.0:0              LISTENING
  TCP    192.168.0.5:139        0.0.0.0:0              LISTENING
  TCP    192.168.0.5:49555      192.168.0.11:80        TIME_WAIT
  TCP    192.168.0.5:49556      192.168.0.11:80        TIME_WAIT

          Solution: this is easy to remember "netstat -a" command. Above screen show you Port number 139 is opened and wait "LISTENING" some others to call and use its

How to disable port 139 on windows 7 ?
1.) Open Control Panel
2)  Click, Network and Internet
3)  Click, Network and Sharing Center
4)  Click, Change Adaptor settings
5) Right click, Local Area Conection














6) Click, Properties
























7) click "Internet Protocal Version 4(TCP/IPv4)































8) and then In General Tab click "Advance..." button.
9) click "WINS" Tab.
10) click "Disable NetBIOS over TCP/IP". and Click "OK" button

Check Again ?
c:\windows> netstat -a
       or
c:\windows> netstat -a |find "139"
Solution: nothing to display,....

Reference:
https://www.securitymetrics.com/howtos/139.adp
http://www.hsc.fr/ressources/breves/min_srv_res_win.en.html.html

No comments:

Post a Comment