Strengthen NT kernel protection to create a secure XP system

System security is valued by every user. For xp systems, it has powerful network functions and stability, but for the xp NT kernel, we have to strengthen security protection.

1.General security protection

The so-called "regular security protection" is the same as Windows98 to install anti-virus software, upgrade system, prohibit Ping three security methods. It should be emphasized that Windows XP and its predecessor, Windows 2000, have numerous loopholes. The upgrade of the system cannot be as sloppy as Windows98. In addition to installing Microsoft's vulnerability patch for "Blast Wave", it is recommended to upgrade WindowsXP to the latest ServicePack1 ( After the upgrade, the resource possession will be increased, but the security and stability will be improved).

2. Disabling Terminal Services Remote Control

"Terminal Services" is a form of service left by Windows XP on Windows 2000 systems (Windows 2000 uses this service to implement remote server hosting). Users can use the terminal to achieve remote control. “Terminal Services” and “Remote Assistance” are different. Although they all implement remote control, Terminal Services pays more attention to the user's login management rights. Each connection requires a specific login of the current system. ID, and isolated from each other, "Terminal Services" is independent of the invitation of the current computer user, and can log in to the remote computer independently and freely.

Under Windows XP, "Terminal Services" is opened by default (Windows 2000 system needs to install the corresponding components before you can open and use Terminal Services). That is, if anyone knows on your computer A user login ID, and know the IP of the computer, it can completely control your computer.

In the Windows XP system, close the "Terminal Services" method as follows: Right-click "My Computer", "Attributes", select "Remote", remove “ Allow users Remotely connect to this computer ” in front of “√”

3. Turn off the Messenger service

The Messenger service is a communication component that Microsoft integrates into Windows XP. It is also opened by default. When using it to send information, as long as you know the IP of the other party, and then enter the text, the corresponding text message window will pop up on the other party's desktop, and will be accepted if the Messenger service is not closed.

Many users don't know how to turn it off, but they are harassed by information. In fact, the method is very simple, go to the "Control Panel", select "Administrative Tools", start the "Services" item, then right click on the Messenger item, select "Stop" & rdquo;

4. Disable Remote Assistance and Block Idle Ports

There is a feature called "Remote Assistance" on Windows XP that allows users to use MSN when they have difficulty using the computer. The friend on the topic sends a remote assistance invitation to help solve the problem.

And this "Remote Assistance" function is exactly the behavior of the RPC (RemoteProcedureCall) service that the virus is attacking on Windows XP. Users are advised not to use this feature, and should also install the RPC vulnerability tool provided by Microsoft and the "shock wave" immunization program before use. The method of disabling "Remote Assistance" is to open the System Properties dialog box (right click "My Computer", "Attributes"), remove it from the "Remote" item and allow it to be sent from this computer. Remote Assistance Invitation & rdquo; in front of “√”.

The port can be restricted using the "TCP/IP Filtering Service" that comes with the system. Here's how: Right click on the "Network Connections" button and select "Properties" to open the "Network Connection Properties" dialog box. In the "General" category, select the Internet Protocol (TCP). /IP)” Then click the [Properties] button below, in the "Internet Protocol (TCP/IP) Properties" window, click the [Advanced] button below, in the pop-up "Advanced TCP/IP Settings" In the window, select the "Options" option, click the [Properties] button below, and finally pop up the "TCP/IP Filter" window. Add the "Allow only" radio box in the window. “TCP”, UDP”, IP” and other ports allowed by the network protocol, without providing various services, can block all ports. This is the best form of security.

5. Reasonable Management

Windows 2000/XP system, after installation, the system will create an Administrator user by default, which has the highest management authority of the computer. Some users did not set a password for the Administrator user at the time of installation. Hackers use this to log in to the other computer using an advanced user. Therefore, individual users should properly keep the “Administrator” user information. When Windows 2000 logs in, it is required to enter the login password of the Administrator user. After Windows XP starts normally, the Administrator user cannot be seen. It is recommended that users using Windows XP enter the security mode. Add the password for the Administrator user in the “User Account” section of the “Control Panel” or delete it to avoid potential hazards.

6. Prevent IPC default sharing

Windows XP allows any user to get all account and share lists of the system through the empty user connection (IPC$) after the default installation. This is originally for the convenience of LAN users. Resources and files, but any remote user can use this empty connection to get your list of users. Hackers use this feature to find a list of users on the system and use some dictionary tools to attack the system. This is the more popular IPC attack on the Internet.

To prevent IPC attacks, you should start with the default configuration of the system. You can make up the vulnerability by modifying the registry:

Step 1: Set the RestrictAnonymous item of HKEY_LOCAL_MacHINESYSTEMCurrentControlSetControlLSA to “1” Can disable empty user connections.

Step 2: Open the HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesLanmanServerParameters entry in the registry.

For the server, add the key value “AutoShareServer”, type is “REG_Dword”, the value is “0”.

For the client, add the key value “AutoShareWks”, type is “REG_DWORD”, the value is “0”.

Xiaobian introduces the six aspects of prevention points to you. Through these six aspects of prevention, the security of the NT kernel can be enhanced, thus ensuring the security of the XP system.