DoS or cmd may only show whether the port is open. Cannot be used to close or open ports !! Enter netstat-an in the cmd command line to view the port opened by yourself. The IP address is followed by the port number. About how to disable the system of the ports with the most intrusion.
1. how to disable the system: (1) port 21:
Port Description: FTP is the most common method used by attackers to open an FTP server called "anonymous.
These servers have read/write directories. Hackers or crackers use these servers
Send warez (Private Program) and pr0n (deliberately misspelled words to avoid being divided by search engines)
Class. Close method: Control Panel-management tools-Service
Disable the FTP Publishing Service, which provides the Internet information service.
Provides FTP connection and management. (2) port 23
Port Description: Telnet intruders are searching for remote UNIX services. In most cases, intruders Scan
This port is used to find the operating system of the machine. In addition, other technologies are used
The attacker will find the password. Close method: Control Panel-management tools-Service
Disable the Telnet service, which allows remote users to log on to the system and use command line operation control.
Middleware program. (3) port 25
Port Description: SMTP attackers (spammer) are looking for SMTP servers to transmit their spam.
The accounts of intruders are always closed. They need to dial up to connect to the high-bandwidth e-mail server.
To transfer simple information to different addresses. SMTP server (especially Sendmail)
Is one of the most common methods to access the system, because they must be completely exposed to the Internet and
Mail routing is complex (exposure + complexity = weakness ). Close method: Control Panel-management tools-Service
Disable the Simple Mail Transport Protocol (SMTP) Service. Its function is
Send email across networks. (4) port 80
Port Description: Port 80 is HTTP (HyperText Transport Protocol, Hypertext Transfer Protocol
(Recommended) open, which is the most widely used protocol for surfing the Internet. It is mainly used in WWW
(World Wide Web, World Wide Web) service information transmission protocol. Close method: Control Panel-management tools-Service
Disable the WWW Service. The "service" name is displayed as World Wide Web
Publishing Service, which provides Web
Connection and management. (5) ports 135
Port description C-serv ms rpc end-point mapper Microsoft runs DCE on this port
RPC end-point mapper serves its DCOM. This works with port 111 of UNIX.
Similar. Use the end-point mapper on the machine for DCOM and/or RPC services
Register their locations. When remote customers connect to machines, they query end-point
Mapper finds the service location. Similarly, hacker scans the machine's port to find
For example, is exchangeserver running on this machine? What version is it? Close method: Open your system with a 16-bit editing software (ultraedit is recommended)
The RPCSS. dll file in winnt/system32 or X:/Windows/system32.
Search for 31 00 33 00 35
Replace with 30 00 30 00 30
Search for port 3100330035 and replace it with port 3000300030, that is, port 135
Change to 000. Now that the task has been modified, the following problems may occur.
Because the file is running, it cannot be overwritten in windows. If you are
FAT32 file system, direct boot into the DOS environment, overwrite the modified File
The original file.
If the NTFS format is used, it is relatively troublesome. Security mode. Then start the pulist Column
In the future, use the pskillprogram (the hacker website has a lower-level killer svchost.exe
Program. And then copy it.
Overwrite and restart. Run the netstat-An command.
No port 135 is available. The XP system also has TCP 135, But UDP does not
Port 135.
(If you do not understand the above method, I have found a method for disabling images.
Http://www.pcpop.com/hard/03/8/26909.shtml) Detailed Method for disabling port 135:
Http://www.shengfang.org/blog/p/block135port.php (6) ports 139
Port Description: file and print sharing
NetBIOS/smb service. This protocol is used for Windows "file and printer sharing"
And Samba. Sharing your own hard disk on the internet is probably the most common problem.
IPC $ depends on this port. 7) port 445:
Port Description: port 445 is the port for information flow data. Generally, hackers use this port
Windows and later versions will automatically enable this
Port. General epidemic viruses, such as shock wave, shock wave, and disaster recovery fly from this port
Computer attacks started! Close method: port 445 can be blocked by modifying the Registry
Add a key value
Hive: HKEY_LOCAL_MACHINE
Key: System/ControlSet/services/netbt/parameters
Name: smbdeviceenabled
Invalid: REG_DWORD
Value: 0
Restart the machine after modification. (8) ports 3389
Port Description: 3389, also known as terminal service, is a service terminal. Start enabling in WindowsNT
A terminal used, which cannot be installed in Win2k Professional version.
You can install the service only in or later versions. The service port is 3389. Because of its simplicity
Single, convenient and other features, has been affected by the system administrator. Because of his simplicity,
Interactive login is not generated and can be performed in the background, which is also favored by hackers.
Love. The fact is that most of my friends want to open windows after intrusion.
Terminal Services, or even restart the other party's computer, also need to install the Terminal Services
This shows its universality. In the XP system, Remote Desktop is also called ". Close method: port 3389 is the port opened by the Windows Remote Management Terminal. It is not
For a trojan program, check whether the service is open by yourself. If not required
, Disable the service. How to disable Win2000:
Start win2000server --> program --> management tool --> locate the Terminal Services Service item in the service,
Select the property Option to change the start type to manual and stop the service.
Start win2000pro --> set --> control panel --> management tools --> Terminal Services in the service
Service, select the property Option to change the Startup Type to manual, and stop the service.
How to disable WINXP:
Right-click on my computer and select Properties --> remote, and remove the check box between remote assistance and Remote Desktop. (9) ports 4489
Port Description: Port 4899 is a remote control software (Remote Administrator) service.
The port listened by the client. It cannot be regarded as a Trojan, but it has the remote control function,
Generally, anti-virus software cannot find out whether the service is open by yourself.
And is required. If not, disable it. Close method: Enter cmd in start --> Run (command below 98), then CD
C:/winnt/system32(your system installation directory, input r_server.exe/stop
Press enter and enter r_server/uninstall/silence to C:/winnt/system32.
(Delete r_server.exe admdll. dll radbrv. dll from the system directory) (10) default share:
Many people do not even know that the default share is the same. The default share is enabled when the system is installed in a unified manner. share C and D with C $ and d $ by default. in fact, this is quite dangerous. It is equivalent to opening a door to let the black class in. there are many ways to intrude. among them, IPC $ is the most famous. so close it. there are many methods to disable it. Port Description: This is when the server is installed, the system installation partition is automatically shared, although its access
The Super User Password is required, but this is a potential security risk.
You 'd better disable this "default share" to ensure system security. Closing method: there are many ways to disable the default sharing method. I will summarize the methods based on my own knowledge.
The four most common methods are described.
1. Delete share under DOS
Click Start/run. In the run window, Enter cmd (98 is command) to open the CMD command line. use the net share command to check whether the default share and IPC $ are enabled. All the shared information can be displayed in it. select the share you want to delete. use Net share XX/delete (here XX indicates the shared file you want to delete) for example: NET Share C $/delete means to delete the default share of drive C (according to my experience, net share C: // Delete is actually the same as deleting the default share of drive C ).
2. drive letter attributes
Confirm the drive letter you want to delete and right-click it to select the sharing and security options. in the displayed window, select not to share this folder. click OK. in this way, sharing is disabled (including default sharing ).
3. Delete from control panel
Control Panel-Administrative Tools-Computer Management-shared folder-share
Disable default sharing (including deleting admin $)
4. Modify the Registry
Click Start/run. In the run window, enter Regedit to open the Registry Editor and expand HKEY_LOCAL_MACHINE/system/CurrentControlSet/lanmanworkstation/parameters ", create a dual-byte value named "auto‑wks" in the right window and set it to 0 (Win2000 professional Win XP); [HKEY_LOCAL_MACHINE/system/CurrentControlSet/services/
LanmanServer/parameters] AutoShareServer = DWORD: 00000000 (Win2000 Server, win2003 server) so that you can completely disable "default share ". The above ports are the most common intrusion ports and are also the most suitable computers for normal users. for ports opened by other specific software, you can create an IP Security Policy to shield the ports. add firewall rules to shield the ports; filter the port through the TCP/IP filter of the local connection to disable the port. the following describes how to disable a port by creating an IP Security Policy,
2. Create an IP Security Policy to shield the Port:
The closed ports include 135,137,138,139,445,102, 3389,593, and TCP.
The procedure is as follows:
By default, many windows ports are open. When you access the Internet, network viruses and hackers can connect to your computer through these ports. To change your system to a copper wall, you should close these ports, mainly including TCP 135, 139, 445, 593, 1025, and UDP 135, 137, 138, and 445, some popular Backdoor Ports (such as TCP 2745, 3127, and 6129) and remote service access port 3389. The following describes how to disable these Network Ports in WINXP/2000/2003: Step 1: click "start" menu/settings/control panel/management tools, double-click to open "Local Security Policy", select "IP Security Policy, on the local computer ", right-click the blank position in the right pane, and select "create IP Security policy" (as shown in the figure on the right) in the shortcut menu. A wizard is displayed. Click "Next" in the Wizard to name the new security policy. Then, press "Next" to display the "Secure Communication Request" screen, remove the hooks on the left of "Activate default rules" on the screen. Click "finish" to create a new IP Security Policy. Step 2: Right-click the IP Security Policy. In the "properties" dialog box, remove the hook on the left of "use add wizard" and click "add" to add a new rule,
Then, the "new rule attributes" dialog box is displayed. Click the "add" button on the screen to bring up the IP Filter list window. In the list, click "use add wizard"
Remove the hooks on the left, and then click "add" on the right to add a new filter. Step 3: Go to the "Filter Properties" dialog box. First, you will see addressing. Select "any IP Address" as the source address, and select "my IP Address" as the target address ";
Click the "protocol" tab, select "TCP" from the "select protocol type" drop-down list, enter "135" in the text box under "to this port", and click
Click the "OK" button (such as the picture on the left) to add a filter to shield TCP 135 (RPC) port, which can prevent external connection to your computer through port 135.
Click "OK" and return to the filter List dialog box. A policy has been added. Repeat the preceding steps to add TCP 137, 139, 445, and 593.
Ports and UDP 135, 139, and 445.
Repeat the preceding steps to add a blocking policy for TCP ports 1025, 2745, 3127, 6129, and 3389, create a filter for the preceding port, and click OK. Step 4: In the "new rule attributes" dialog box, select "new IP Filter list" and click a dot in the circle on the left to indicate that the IP address has been activated,
Click the filter action tab. On the "Filter Operations" tab, remove the hook on the left of "use add wizard" and click "add" to add
"Block" Operation (right): On the "Security Measures" tab of "New Filter operation attributes", select "Block" and click "OK. Step 5. Enter the "new rule attributes" dialog box and click "New Filter operation". A dot is added to the circle on the left to indicate that the operation has been activated. Click "close" to close the dialog box; return to the "new IP Security Policy attributes" dialog box, tick the left side of the "new IP Filter list", and click "OK" to close the dialog box. In the "Local Security Policy" window, right-click the newly added IP Security Policy and select "Assign ".
So after the restart, the above network port on the computer will be closed, and the virus and hackers will
You cannot connect to these ports to protect your computer. My suggestion: If the port you want to close is a common intrusion port, I suggest you use the system closing method. this is more direct and effective. if you do not want to enable a normal port, you can disable it by using an IP Security Policy or firewall or TCP/IP filtering. in the future, when you want to open this port or use the software, you only need to remove the rules. we also remind you that ports starting from 1024 to 65535 are ports enabled by the application (including Trojans and viruses, of course ). unless you are sure that this port is a Trojan, virus, or unused port, you are not advised to disable it. otherwise, many problems may occur. Basic knowledge about computer ports
Ports can be divided into three categories:
1) well known ports: from 0 to 1023, they are closely bound to some services. Usually the communication between these ports clearly indicates a service protocol. For example, port 80 is always HTTP Communication.2) Registration port (registered ports): from 1024 to 49151. They are loosely bound to some services. That is to say, many services are bound to these ports, which are also used for many other purposes. For example, many systems process dynamic ports starting from around 1024. 3) dynamic and/or private ports: From 49152 to 65535. Theoretically, these ports should not be allocated to the service. In fact, machines usually allocate dynamic ports from 1024. But there are also exceptions: Sun's rpc port starts from 32768. |
