Port 138 and Port 139

Hi,

I just reformatted my PC and installed norton corporate edition antivirus
and spyware sweeper and zonealarm. I'm sharing one drive on my local
192.168.1.x network.

I detected that my PC 192.168.1.2 is sending another PC 192.168.1.3 to port 139 on the
same network LAN, packets of TCP flag:S, in intervals of 10 minutes.
Is my PC infected with trojans/viruses?

PC 192.168.1.3 sends UDP packets to my port 138 once in a while,
are we infected?
jedistarAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

sirbountyCommented:
137 - 139 are used for NetBIOS resource sharing.  See http://www.windowsitpro.com/Article/ArticleID/20561/20561.html
This is normal...

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
JammyPakCommented:
if you look at the contents of the packet, I would guess that the destination address is actually a broadcast address, and that this is a NetBIOS broadcast announcement - the Server service is the one creating this, and if you are sharing folders than you need the Server service to be running.

You can tell your PC to stop announcing itself (and still share folders) by executing:
net config server /HIDDEN:YES

but note that this means you will eventually disappear from people's browser lists
misterbeefySharePoint ArchitectCommented:
What JammyPak said is correct. Those are the ports used by the Computer Browser service. This has to run for you to be seen in Network Neighborhood/My Network Places. It runs on UDP ports 137 and 138 and TCP port 139.
Tim HolmanCommented:
You could use www.ethereal.com to verify this behaviour and see what's going on.
As the packets aren't so frequent, I suspect this is normal.  However, if you start seeing hundreds of these packets per second, it is then you should start to worry and suspect worm infection.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
OS Security

From novice to tech pro — start learning today.