I also found that port 139 was open. Are 137 always open, even if I don't have file sharing on, or what?

Could a hacker get access to all my files if I use file sharing, and not only the ones I share?