Comments on top ten hidden danger services of Windows operating systems

 

Nowadays, many people tend to use the Server operating system to set up network services. It is undeniable that compared with the Pro Version System, the Server version system indeed provides more powerful network management functions for individual users. However, when you look at the system processes, You can see which services are started in your background for the Server operating system? Are these services secure? Do you really need these services?

Ordinary users often use Windows 2000 Server to set up personal servers. However, some of the services that are automatically started during system running are required for system running, and some can be disabled or disabled. At the same time, many services still have some security risks. We must disable these dangerous services. It seems that casually enjoying "services" will also bring us security risks. Today, let's take a look at the top ten services that individual server builders need to change or use with caution.

Tip: Windows 2000 Pro users can also learn about the services in their systems through this article. Because the system is designed for individual users in the family, the network management tools provided by the system are not perfect. Therefore, for general users who want to set up personal servers, or use Windows 2000 Server.

Messenger

Hazard type: Information harassment

Hazard coefficient:★★★

This is a service that sends and receives messages from system administrators or alarm services.

Since Microsoft launched a 32-bit operating system in the middle of 1990s, this service has been an indispensable part of Windows operating systems.

Currently, many spam senders use this function to send spam information to computer users. We recommend that you disable this service.

Remote Registry Service

Hazard type: malicious attack

Hazard coefficient:★★★★

This service allows remote users to modify the registry settings on the local computer through simple connections.

It is easy for people who know the Administrator account and password to remotely access the registry. Open Registry Editor and select the "Connect Network Registry" option in the "file" menu, in the "select computer" dialog box, enter the IP address of the recipient in the "enter the name of the object to be selected" text box, click "OK". A "enter network password" dialog box is displayed. Enter the Administrator account and password and click "OK" to modify the registry of the target machine.

Currently, many Trojan and Backdoor programs can use this service to modify the registry of the target machine. We strongly recommend that you disable this service.

Workstation

Hazard type: Information Leakage

Hazard coefficient:★★★

The service works as a file system drive and allows users to access resources on Windows networks. This service should only be located in an internal network and be subject toFirewallRun on the protected workstation and server. Disable this service on any server that can connect to the Internet. Note that some independent servers (such as Web servers) should not be added to a Windows network.
ClipBook

Hazard type: Information Leakage

Hazard coefficient:★★★

This service allows other users in the connected network to view the clipboard of the local machine. To ensure security, we strongly recommend that you set this service to manual. The ClipBook Viewer program supported by ClipBook allows users to cut pages and paste texts and images through network connections.

Computer Browser

Hazard type: Information Leakage

Hazard coefficient:★★

This service provides the list of computers on the network used by the current machine to the programs that request the list (probably malicious programs ), many hackers can use this list to identify and launch further attacks on all online computers on the current network. We recommend that you disable this service.

Indexing Service

Hazard type: Information Leakage

Hazard coefficient:★★★★★

Indexing Service is a search engine. This indexing service is the root cause of many security vulnerabilities on most IIS Web servers. At the same time, it is also the culprit of many worms. For example, the red code that once became popular is spread by using the buffer overflow vulnerability and Index Service of IIS, the famous blue code and Nimda spread by exploiting the IFRAMEExecCommand and Unicode vulnerabilities of IIS services.

Therefore, if you do not need to set up a Web server, you must disable this service.

DNS Client

Hazard type: Information Leakage

Hazard coefficient:★★

This service is used to query DNS Cache records. It can be used to query the DNS of an intruded System to accelerate the DNS query speed. After obtaining the user's Shell, attackers can use the ipconfig/displaydns command to view the user's cached content and obtain the website you have visited.

Server

Hazard types: Information Leakage and malicious attacks

Hazard coefficient:★★★★★

This service provides RPC support and file, print, and named pipe sharing. The Server service is implemented as a file system drive and can process I/O requests. If you do not provide proper protection, system files and printer resources are exposed.

For Windows 2000, this is a high-risk service. In Windows 2000, this service is shared by default. If you do not disable this service, the sharing will be enabled by default every time you log out of the system or start up, and all your important information will be exposed. At the same time, many Windows 2000 users set the administrator password to an empty password or a simple combination of passwords for ease of use, which gives hackers a chance to access.

We would like to remind you not to run this service unless you plan to share files or printers on a Windows network.

TCP/IP NetBIOS Helper Service

Hazard type: malicious attack

Hazard coefficient:★★★★

In a Windows Network, the unique identifier of each host is its NetBIOS name. The system can use WINS service, broadcast, and Lmhost files to resolve NetBIOS names to corresponding IP addresses for information communication. In such a network, it is very convenient and fast to use NetBIOS name for information communication. But on the Internet, it is similar to a backdoor program. It is likely to expose NetBIOS security vulnerabilities in the current system. For example, we are familiar with port 139 intrusion by using this service.

Because NetBIOS is based on LAN, you can disable NetBIOS only when you access Internet resources, unless your system is in LAN.

Terminal Services

Hazard type: malicious attack

Hazard coefficient:★★★★★

This service provides a multi-session environment that allows client devices to access virtual system desktop sessions, Windows-based programs running on servers, and opens an external port of 3389 by default, allow connections from external IP addresses (the service that the famous 3389 attack relies on ). For this very dangerous service, only "Disable ".

How to configure the service: Enter the "service" window, right-click the service to be configured, and then click "properties ". Click "automatic", "Manual", or "disabled" on the "General" tab as needed ".

If the services with many security risks are not concerned by the majority of individual server enthusiasts, hacker intrusion will be easy, and server attacks will only happen sooner or later. I would like to remind you not to ignore all seemingly insignificant settings. In fact, the rational use of Windows's own security mechanisms can also greatly improve the server security factor.