According to the development trend of trojans and worms, all the ports of computers may become common ports of trojans and worms, and the default ports that trojans and worms think may also be safe ports. For example: TCP 139, 445, 593, 1025, 25 13, 2745, 3 127, 6 129 and UDP 123. However, if the ports 137, 138, 139 and 445 are forcibly closed, the NetBios protocol cannot be started and the LAN resources cannot be enjoyed. For users who are not in the LAN, sometimes even the local printer can't be used, which may also cause the error of information rotation in this system. As we all know, port 80 is a necessary port for surfing the Internet, and it must be turned on, otherwise the hypertext transfer protocol cannot be started, but it is also the default port for Trojan programs such as Executor and RingZero.
Second, the drawbacks of network circulation security settings.
At present, the main security settings circulating in the network are: 1, closing unused ports in the machine; 2. Delete useless accounts in the system.
But in the final analysis, it is difficult to close the port and cancel the system protocol (function) in both settings. For example, TCP\UDP 1-5 12 is a dangerous low port, and many Trojans and worms enable the low port by default. If it's hard for them to shut down, they can't even connect to the internet. Deleting the Guest and Administrator accounts is not allowed. If you forcibly delete them according to the popular methods in the network, it is likely to cause a crash.
Third, the implementation principle of firewall port rules (IP rules) is explained.
External port monitoring+access rules+built-in feature authentication code instruction program matching = port filtering instruction start; External port monitoring+access rule = start port closing instruction.
The best way to set computer port security is to filter the port, not to close it!
External rules are used to close, but they must match the internal rules, otherwise, the relevant ports can only be closed hard, and only the interaction between internal and external rules can filter the data in and out of the ports.
For example, port 80 must be opened, but related trojans must be prevented from entering. Therefore, port 80 of TCP\UDP must be closed according to external rules, and at the same time, packets with characteristic values of Ce63D1D216E713cf must be filtered according to built-in rules, and then passed through TCP \ UDP ports UDP3 1337, 547.
Four, Block NetBus Trojan and other conventional Trojan hexadecimal eigenvalue.
Eigenvalue of block network bus Trojan: 4e6574427573
Eigenvalue of Huck's' a' Thumbnail Troy: 486 154.
Troy's eigenvalue of paradise master: 4765744167656e749666fff4c69737420fff4c69737452656747261636b73ff.
Donald Dick Troy Eigenvalue: 4f4b00
Doomsday Gate Troy Eigenvalue: 706f64
Eigenvalue of Spherical Troy: 3c4e6574537068657265
Trojan eigenvalue of NetMonitor: 4E65747370792056657273696f6e20312e30204f4b21.
Trojan eigenvalue of coma: 434 f4d 4658+020536572765.
Eigenvalues of Glacier Troy:
4545454545454545454545454545454545454545454545454545454545454545454545454545454545454545454545454545454545454545
Worm 2003 eigenvalue: 040101kloc-0/01.