Set an IP Security policy to prevent Trojan Horse viruses from outside the port

Source: CCID Author: kaduo

Trojans are a headache for users. They quietly enter our system, making it difficult to prevent them. When a trojan quietly opens a "convenient Portal" (port), the uninvited client will intrude into your computer without any knowledge. If a trojan is planted, you don't have to worry about it. First, we need to cut off their contact with the outside world (that is, block the Suspicious Port ).
In Windows 2000/XP/2003, Microsoft Management Console (MMC) has integrated the system configuration functions into the configuration module, it is very convenient for us to make special settings (taking port 23 used by Telnet as an example, my operating system is Windows XP ).

Procedure

Click "run" and enter "mmc" in the box, and press Enter. The "console 1" window is displayed. Choose "file"> "Add/delete Management Unit"> "add"> "IP Security Policy Management" in the independent tab column, and complete the operation as prompted. At this time, we have added the "IP Security Policy" to the "Console Root Node" on the Local Computer (hereinafter referred to as "IP Security Policy.

Now, double-click "IP Security Policy" to create a new management rule. Right-click "IP Security Policy" and select "create IP Security Policy" from the shortcut menu to open the IP Security Policy wizard, click "next> the default name is" new IP Security Policy ">" Next ". You do not have to select" Activate default response rule ". (Note: When you click" Next, you need to confirm that "Edit attribute" is selected at this time), and then select "Finish>" new IP Security Policy attribute> Add> you do not have to select "use add wizard '".

Select "any IP Address" for the source address in the addressing bar, and select "my IP Address" for the target address (you do not need to select an image ). In the Protocol Label column, note that the type should be TCP, set the IP protocol port from any port to this port 23, and click "OK. In this case, a "new IP Filter" will appear in the "IP Filter list". Select it and switch to the "filter operation" tab, click "add> name defaults to" New Filter operation ">" add ">" stop ">" complete ".

The new policy must be activated before it can take effect. The specific method is to right-click the new IP Security Policy and assign the policy just created.

Effect

Now, when we Telnet from another computer to the fortified one, the system reports logon failure. Scan the computer with a scan tool and you will find that port 23 is still providing services. In the same way, you can block any other suspicious ports.