NetBios Issue

Viewing 1 reply thread
  • Author
    • #2853

      Currently we have a system open on our CheckPoint firewall that enables all traffic from the outside (i know this is horrible, and I’m trying to have this fixed). But I saw in our logs today that it was accessed via port 139 multiple times. I know this is a NetBios port and I’m concerned. I can’t think of any legitimate reason to have a machine connect to that port from the outside world.

      My question is, where should I start looking to see if this machine was compromised? Are there any tools that can be run? Logs that I should look at? Any advice would be of great help.



    • #19852

      Netstat -an will give you connections established, hopefully nothing from the outside  :'(

      procexp.exe will give you a list of running processes, check out extraneous or if you have been done over they could using a system process to cloak there access.

      What about another question, do you need netbios on your network, can you close this and other ports, is this in the DMZ, if it is close everything you can to reduce your attack vectors:

      Port 139 (TCP) and Port 137 (UDP)

      This is closed by following the following procedure:

      • Right click My Network Places
      • Select properties
      • Double-click Local area connection
      • Click Properties
      • Double click TCP/IP Connections
      • Click advanced
      • Click WINS
      • Tick disable NetBIOS over TCP/IP

      For extra security, you should also deselect file and printer sharing on the Local area connection main page, general tab

      Port 445

      Port 445 can be disabled on the host by using the following instructions :

      • Select Start
      • Select Run
      • Type in Regedt32
      • Locate the following key in the registry:

      o HKLMSystemCurrentControlSetServicesNetBTParameters

      • Double-click on the key TransportBindName.
      • Delete the value (Device), and leave the box blank.

      • Close the Registry Editor
      • Reboot your computer.

      TCP Port 445 is now closed.  This can be confirmed on the localhost by running the netstat command

      Port 135 (TCP)

      RPC services can’t be disabled but the parameters referencing the listening interfaces can be modified to bind this port to the localhost ( and thus disallow access from external connections :

      • Create a registry key file with the following contents:

      cut here

      Windows Registry Editor Version 5.00



      cut here

      • Save as 135.reg
      • Double-click 135.reg

      The keys are now written to the registry.

      By default RPC listens on all network interfaces, this can be modified by creating the following Registry key and string (ListenOnInternet REG_SZ = N
      ) at the following location:

      • HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesRpcSs

      When this value is set to N (NO)  the port 135 is listening only on interfaces listed in the value “Bind”=1 which correspond to the localhost.
      (or MS TCP Loopback interface)

      Disable DCOM

      This is achieved by setting the following string (EnableDCOM Reg_Sz = N) in the registry key:


      Reboot the machine.

      Port 135 is now bound to localhost. This can be confirmed on the localhost by running the netstat command

      Just locked down a 2K3 server with this and lots of other tweaks you really need to assess what you actually need open and what services you need to run.

      Hope this helps


Viewing 1 reply thread
  • You must be logged in to reply to this topic.

Copyright ©2020 Caendra, Inc.

Contact Us

Thoughts, suggestions, issues? Send us an email, and we'll get back to you.


Sign in with Caendra

Forgot password?Sign up

Forgot your details?