Due the vulnerability in Windows SMB Server (MS17-010), how can I tell if it is running? I am using Windows XP. None of the services I have running has the word "SMB" in the title or description.
What is the name of the service that implements SMB Server?
Answer to this question:
(1) There is no service that runs the SMB server. It is a native system process that runs in the NT kernel.
(2) If the kernel is running SMB, it can be detected by giving the command netstat -an to display all network listeners. If port 445 is listening, then it means the SMB server is running.
In Windows, you can open cmd.exe and run this command:
sc query mrxsmb10
In addition, you can also check to see in Windows Registry if there is a key for SMB in (it's not always present):
HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters
Lastly, powershell can be useful. Open PowerShell in Windows and run:
Get-SmbServerConfiguration
SMB is Server Message Block protocol–it's used for file sharing so if you have enabled windows file-sharing–you have a service using the SMB protocol.
If you are on Windows XP you would have to turn off all the file sharing which means no access either to or from files on the machine.
You could try in you network adapter settings to locate a binding named something like "File and Print Sharing for Microsoft Networks", and unbind this. It may be just as easy as turning off the network card.
See also Disable file sharing on Windows XP on Superuser as my suggestion to unbind evidently doesn't work.
