Computing.Net > Forums > Security and Virus > help closing port 139

Computer Problems? Computing.Net has over 1,000,000 posts about all things technology related! Over 90% answered within 24 hours! Click here to start participating now! Also, be sure to check out the New User Guide.

help closing port 139

Reply to Message Icon

Name: Mike S.
Date: July 17, 2002 at 23:36:54 Pacific
Comment:

I did one of those security scans and it said Port 139 was open and so was ICMP ping. How do I close these? I know port 139 has something to do with networking and NetBios but that's about all I know. Also, if I need to disable anything will it involve needing to use the Windows 95/98 CD? Last time I disabled something it said to insert the CD but my CD-ROM drive is broken so I can't. And I'm running Windows 98SE upgraded from Windows 95.

Thanks



Sponsored Link
Ads by Google

Response Number 1
Name: badmama
Date: July 18, 2002 at 03:04:46 Pacific
Reply:

Hi there - You're right in thinking you should close port 139. Having this open is certainly bad news in terms of security. To be honest I'm not 100% sure with regard to 98 and requesting the CD but disabling File & Print Sharing & Client for Microsoft Network from your DSL/Modem/ADSL network properties will stop the machine responding for Netbios session requests. As you're worried about the CD issue you could download a Free Firewall. Try www.zonelabs.com and download the free ZoneAlarm firewall (you should download this anyway as it will protect you from alot more than just port 139 open e.g ping death etc. Hopefully this wouldn't require the 98 CD to be inserted for this install to complete.

If all else fails buy your self a new CD Drive :) Obvious I know but if you continue running machine in this 'open state' Some muppet will hack your machine and nothing will work ;)

Failing that do you have another machine available? You could take the drive from that or if the machines are networked it's easy to just share insert the CD and 'share' it to the machine with the problem.

Hope some off this helps

Rob


0

Response Number 2
Name: Speedy
Date: July 18, 2002 at 06:22:37 Pacific
Reply:

grc.com (Gibson Research) has ALOT of info for security help, there is info there to show you how to close it, as above post says it is a well known security risk & should be attended to. & Zone Alarm in my opinion is the best firewall out there, the tests @ grc.com will show you.


0

Response Number 3
Name: DBPowerWCRulez
Date: July 18, 2002 at 22:22:22 Pacific
Reply:

Hi there,

The NetBios port 139 very dangerous as WinNuke can send high bandwidth packets to uncontrolling your puter get a blue screen of death indicates "MACPPP" strings, most hackers on the IRC chat servers snatched your real IP address (Efnet servers) and run a winnuke to crash your puter up.

I had that f-ing hacker played on mine for long time ago on windows 95b system..


0

Response Number 4
Name: TO ALL
Date: July 19, 2002 at 22:14:57 Pacific
Reply:

ok mike i just emailed you also about this. just by disabling the file and print share does nothing to close this problem at all, but it does close another gap in your hole. DBPowerWCRulez that's just one of many things people can do. just a lamerz fun. to be honest kind of stupid. port 139 can be used to get alot of things from you NetBios. how fun all you need to do is do a nbtstat on the ip address to get the shares and then al you need to do is find the password. so disabling file and print shares is not going to work.


0

Response Number 5
Name: DBPowerWCRulez
Date: July 20, 2002 at 23:36:18 Pacific
Reply:

To ALL,

yea, I have a ZA firewall and disabling the Netbios on my TC/IP settings. :)


0

Related Posts

See More



Response Number 6
Name: :)
Date: July 21, 2002 at 09:57:18 Pacific
Reply:

DBPowerWCRulez
first of all you shouldn't really have the netbios protocall set up unless your running a network and want to share. sure you can disable the little button that says disable the filesharing but did you remove the protocol?


0

Response Number 7
Name: DBPowerWCRulez
Date: July 21, 2002 at 21:22:19 Pacific
Reply:

:),

Long time ago on my win95b puter, the netbios was enabled, I joined into IRC chat online. the nuker runs a WinNuke make nuking on my system to totally controlless (cannot handle the data packets to wastes) to crashed it up, got a blue screen of death indicates "MACPPP" strings until I upgraded new DUN version. I disabled the NetBios setting which is never use that protocols.
Until I downloaded nukenabber program (not a firewall program, only to be show alert warning), I added the Nukenabber script on my mIRC, if the nuker tried to nuke on mine, the script detected "Nuke" and kicked and banned on nuker out of the chatroom for example:

HavocWarScript joined #blahblah
Hello, you're f-ing lame room, I'm gonna crash your box!
Hi!
-> -#blahblah- NUKE DETECTED: HavocWarScript
* Deafy set mode +b HavocWarScript@IPaddy.net
* Deafy had kicked HavocWarScript from #blahblah (Nuke detected port 139)
Hmmm.. nuker pretty lamer and dumb lol!
H3ll yea!

It's very OLD script :)

2 years later finally FREE zonealarm firewall downloaded I turn off the Nukenabber and removed it, installed the firewall, wow that beautifully blocking on them nothing get crashed on mine..


0

Response Number 8
Name: DBPowerWCRulez
Date: July 21, 2002 at 21:33:43 Pacific
Reply:

Oh darn, the in the nickname line had been stripped it out on this board :( :(

here is
* HavocWarScript had joined #Blahblah
HavocWarScript: Hello, you're f-ing lame room, I'm gonna crash your box!
Deafy: Hi!
..see list response 7 above..
BearCave: Hmmm.. nuker pretty lamer and dumb lol!
Deafy: H3ll yea!


0

Response Number 9
Name: :)
Date: July 21, 2002 at 23:18:01 Pacific
Reply:

DBPowerWCRulez
so what your trying to say is your a lamer that has to use a program to crash someones system. not only that it's just childs play anyway. i already know what the program is and what it does. do you know how to do it without a program or i should say a script kiddie prog. i used to play around with that when i was 14 seeing im 10 years older now im a lot into the more advanced setting or you can say elite.


0

Response Number 10
Name: DBPowerWCRulez
Date: July 22, 2002 at 23:53:30 Pacific
Reply:

:),

Hello again :) :)

that was my old nickname Deafy. HavocWarScript other person trying to crash on ppls's puter up. Since I don't use the Dalnet anymore, (too many virus senders on the IRC), now I own the IRC server they're nice and friendly ppls on the net.

I guess probably not allowed to adversiting in this board about my own IRC server. You can click my webpage to join my server :)


0

Response Number 11
Name: Bryan
Date: July 24, 2002 at 06:20:27 Pacific
Reply:

If you're not using file sharing, the easiest way to close port 139 is to rename vnbt.386 to vnbt.old or delete it altogether. This will make 139 a stealth port.


0

Response Number 12
Name: Harry Highlife
Date: July 29, 2002 at 19:39:42 Pacific
Reply:

Hi,

Zone Alarm (Free version) is generally recognized as good security but ....... for whatever reason once in a while it just went wild and opens up everything ! ! I don't think this has to do with a hacker, the program itself just decides to take on an eagle trip whenever ! Exit and reenable Zone and everything goes fine again. Just want everybody to be on the alert, not thinking that Zone protects you every minute. It takes only a minute for a hacker to realize that you are suddenly without protection 'cause they are constantly scanning !

The best Firewall these days I can find is Kerio ! Superb, nothing to compare in detailed settings ! You can add as many rules as you want to block single port, or multi ports, single address or all, single program or all programs, differences of in's or out's settings, or combination of these settings, the types of protocol setting etc. Editing after rules setting up is also easy. I even set up extra TCP block to block Netscape from phoning home, which action otherwise actually gets away without notice because by default, some of the phoning functions of legitimate programs are not blocked by these Firewalls. You will just have to suspects, just have to know what to look for, and set up your own blocking rules. I suspect that most of the legitimate programs do do you-wash-my-back - and-I-wash-your-back stuffs ! On the other hand, automatically blocking wise, Zone blocks 2 while Kerio already does 80 incoming blocks ! Yes, Zone is too lazy, stuffs kept coming through and went out easily until I got Kerio, then I found out just how safe I was with Zone before ! Perhaps the paid-for Zone version can be better, I am not sure, never paid for a Zone yet.

But as always, any of these security programs are actually spyware itself ! ! Every Firewall phones home, Even browser, M/S Explorer, M/S Internet Explorer, Netscape Browser, no difference, everyone wants to share that piece of the pie ...... Info on what customers wants, how customers set their browser, what other similar programs customers have in their machines, where surfed etc etc)

Lastly, I had the 30 days (Was it 30 days ? ?) free trial version of Sygate Firewall, it gave me only one day’s use and declared that my time were up ! It then refused to work anymore :-) So I deleted the darn thing and called it the day !

Highlife was here,
Ciao !


0

Response Number 13
Name: jon
Date: August 13, 2002 at 18:24:32 Pacific
Reply:

harry the only thing the other firewall that you use has is something to look at incoming and out going transmissions of programs other then that it looks like another cop off of zone alarm. not only that you meaning YOU have to learn then of what to set up as server or not . i would have to agree with my friend joe on this on bud. question how do you test your firewalls?


0

Sponsored Link
Ads by Google
Reply to Message Icon

choosing a free firewall Please help!!!



Post Locked

This post is quite old and has been locked from receiving new replies. Please create a new posting instead.


Go to Security and Virus Forum Home


Sponsored links

Ads by Google


Results for: help closing port 139

Close port 139 www.computing.net/answers/security/close-port-139/2998.html

port 139 closed www.computing.net/answers/security/port-139-closed/2533.html

close port www.computing.net/answers/security/close-port/2868.html