The ports that are found on a new install that required closing include the NetBIOS (file and printer sharing) group … ports 137, 138 and 139 … with the associated (on this system) port 445. Also, DCOM port 135 must be closed.

Below is the procedure for closing these ports.

The NetBIOS group of ports

From the desktop, select Start – Settings – Network and Dialup connections. Depending on how many internet adapters you have installed, there may be several Local Area Connection items. Start with your primary hardware adapter. In my case it’s an Ethernet adapter as shown below:

Double click on this item and select Properties. Uninstall everything except Internet Protocol (TCP/IP).
   

Select the Sharing tab and uncheck “Enable Internet connection sharing for this connection”.  Click “OK”.

Right click on the Local Area Connection item again and select “Properties”. Select “Properties” again.
Then select “Advanced”. Click on the WINS tab. Select “Disable NetBIOS over TCP/IP”. 

Click “OK”. There is no need to reboot at this point. Just hit Cancel if prompted.
Check your other adapters (Local Area Connections) to make sure their settings are identical to the new settings of this first adapter.  

Port 445
———–
From the desktop select Start – Run and type regedit
Find the key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBt\Parameters
Double click on the item TransportBindName
Remove the string of characters in Value Data leaving it blank.
Make a note of the Data string value for possible future reversal purposes.

Exit the registy editor.

Port 135
———–
From the desktop, select Start – Run
Type:  c:\winnt\System32\Dcomcnfg.exe
Select “Default Properties”
Uncheck “Enable Distributed Com on this computer”
Select “Default Protocols”
Remove any listed, leaving a blank

Start the registry editor again and find the key:
HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc
With Rpc highlighted, click on Edit at the upper left of the screen. Click on New and then select Key.
You will see a key added under Rpc. Rename the key Internet (See screenshot below).
With that new key highlighted (as below) select Edit again. Click on New and then string. Enter the Name UseInternetPorts. Then double-click on the newly created item UseInternetPorts and enter N for the Data value.

Note that reversal can be done simply by deleting the Internet key you added.
You are done. Exit the registry editor and reboot.

To check your work, open a DOS window (CMD.EXE) and type netstat -an immediately after booting up. I’ve found that when working with a new install of Windows (no updates or patches),  the result is empty. No ports  appear at all. After updating to IE 6 I find a tcp port numbered just over 1024 Listening. Sometimes udp port 68 will appear as well. These ports are not open.  Immediately after hardening, it is ok to go ahead and install Sp 4 and all the critical security patches.

You can verify that all ports are closed by going on the internet, and using web sites which offer port scanning services. 
Here are a few links:

http://scan.sygatetech.com/

http://www.pcflank.com/

https://www.grc.com/x/ne.dll?bh0bkyd2

In addition to backing up all your data, it’s wise to do periodic checks. In the context of this article, one simple check is the net stat -a test to make sure nothing you’ve installed has modified the work you have done here. Make sure to do this check after a Windows Update, or after installing any new Windows services. As said above changes made are reversible. If at later time you wish to enable file and printer sharing with other computers on your local network, there is a free utility named wwdc.exe available which will do much of the reversal automatically.

It’s a good idea to disable services you’re not using in order to further harden the OS and lighten the load on available resources. For example, if you don’t use Fax, disable it. Similarly, Telnet can be disabled. Wideband users can safely disable Telephony. If your computer has no printer installed, the Print Spooler can be disabled. If you prefer to do Windows updates periodically when you do maintenance and backups, there’s no reason to have Automatic Updates enabled. I don’t use Task Scheduler, and I disable it as well.

There are several other items that I’ve disabled, such as TCP/IP NetBIOS Helper Services, Net Meeting Remote Desktop Sharing, Remote Access Auto Connection Manager, Remote Access Connection Manager, and Remote Registry Service.

1. Start-> Control Panel
2. Network Connections
3. Choose your connection- Local area network
4. Click Properties button.
5. Now choose Internet Protocol(TCP/IP) Click Properties.
6. Click the radio button Use the following DNS server addresses and type in OpenDNS addresses in the Preferred DNS server and Alternate DNS server
fields.

I would suggest you to note down the current DNS setting before you set up the Open DNS in case if you want to rollback. Here are the

* Preferred DNS server for OpenDNS server is:

208.67.222.222

* Alternate DNS server address for Open DNS is:

208.67.220.220

This is the method i read from here. For more instruction including screen shot just see this opendns.com