Windows: how to close port 445, features and recommendations

The WannaCry virus, aka WannaCrypt or Wanna Decryptor, hit the virtual world in May 2017. The malicious program infiltrated local networks, infecting one computer after another, encrypting files on disks and requiring the user to transfer ransomware from $ 300 to $ 600 for their unlocking. The Petya virus acted in a similar way, almost gaining political fame in the summer of 2017.

Both network pests entered the victim computer's operating system through the same door - network ports 445 or 139. Following two large viruses and smaller types of computer infections, they began to exploit this vulnerability. What are these ports that scan everything for everyone?

What are ports 445 and 139 in Windows OS responsible for?

Windows . Server Message Blocks (SMB), Network Basic Input-Output System (NetBIOS). Windows «» TCP UDP.

Windows 2000, 445 SMB. NetBIOS , 137, 138 139, .

445 139 , Windows. , , , , . , .

, , . , , . WannaCry Petya, .

, , , 139 445 Windows.

,

445 Windows , Windows. . Win + R, . “cmd” . “netstat –na” Enter. .

. IP- 445. “LISTENING”, , . 139 .

Windows 10/8/7

, 445 Windows 10, 7 8. . . 139.

, 445 Windows, .

1. > > Windows .
2. > . > > TCP > , 445 .
3. . , . , , .

445 . , 139.

Windows.

1. “cmd”. cmd .
2. netsh advfirewall set allprofile state on. Enter.
3. : netsh advfirewall firewall add rule dir=in action=block protocol=TCP localport=445 name="Block_TCP-445". Enter .

Windows 445. , , , : “LISTENING”. , .

Windows

445 . : Windows , . , , CCleaner.

1. “regedit”. Enter.
2. : HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBT\Parameters.
3. . . DWORD (32-bit) DWORD (64-bit) (32- 64-).
4. SMBDeviceEnabled, . 1 0 OK .

, . , 445.

, Windows Server. :

1. "services.msc". Windows.
2. Server . , - .
3. .

( ) 445, 135, 137, 138, 139. .

, Windows 0 1, Windows Server, .

! , 445 Windows , . , , «» .

, . , , .

, , Windows , 139 445.