Disabled NETBIOS

Hi there,

I have a question about ports 137, 138 and 139. I've disabled NETBIOS over connections/properties/internet protocol (tcp/ip)/WINS, I did the same in run/services.msc, but I'm still getting alerts on my firewall (port 137 and 138) from private ip's (they turned out to be my two neighbours). How is that possible?
Thank you for any kind of help.

 

are you sharing a wireless connection? that's the only thing I can think of.

 

No, I'm connected through cable.

 

Could a virus or some kind of malware cause something like that? My AV didn't find anything, but I had some problems with that before...

 

are you running any kind of IM software, i think i used to get that with yahoo messenger with my cousin, whenever i was im'ing him, i would get some connection to his ip.

 

I have a windows live messenger (non of my neighbours are among my friends there) and skype, I got one of my neighbours on my skype list, but not the other one
and I rarely use skype anymore, so it's mostly turned off

this would probably explain one of the ip's, but definitely not the other one

 

do your neighbors have the same isp? that might explain it. going further, they might have some malware problems...

 

No, as far as I know, we don't have the same isp. One of them use a wireless connection, that's for sure.

 

I have the printer and file sharing disabled, and as I said before I also closed down the netbios ports over WINS as well as in services. I don't share anything over messenger or online gaming, as far as I know. I couldn't find the vnetbios.vxd in C:\windows\system folder, it's not even placed anywhere else.

 

I have Netlimiter and it gave me the names of the ip's, both my neighbours use their whole names as the name of their comps.
I have one of them on facebook and skype, but I added him after these alerts have started.
About the vnetbios, I have windows xp, and I couldn't find it anywhere, it's not even amongst the hidden files.
I'm not sure about my firewall settings, I have Eset Smart Defense, it should be configured automatically.

 

I checked my firewall, file and printer sharing is disabled, but the NETBIOS was active. I turned it off. It looks like the alert have stopped for now. I hope it stays that way.
Thank you very much everybody for you help.

 

Well, it worked for about 10 minutes. I don't understand...
During that 10 minutes I got a lot of alerts from an ip which should belong to facebook, but according to dnsstuff it could be forged, because the reverse dns doesn't exist.

 

My AV didn't find anything, actually it hogged the cpu yesterday, I couldn't move a thing, the whole comp was stuck
I reinstalled the AV
I'm going to try the Read and Run me First, should I open a new thread, or post the outcome here?