How to shut down port 1434, how to shut down port 135, 445, 3389

2003 Worm King (Virus Archive:

Virus introduction: It was intercepted by Ruixing Company in China on January 25. It exploits the vulnerabilities of the SQL Server 2000 system and uses the "buffer overflow" technology to carry out network infection and network attacks, thereby causing serious harm to the network and server.

At present, it has spread over a large area around the world, frantically attacking the network, and paralyzing the world's major network systems in a short period of time! The virus is similar to the "red**" virus, which does not spread through files, emails and other media, but directly through vulnerabilities in memory, which creates a large number of fake IP addresses and then attacks these addresses. Due to the aimless nature of the spread of this virus, the network will be severely blocked, resulting in the complete paralysis of SQL Server 2000 servers, causing users to access the Internet.

It is necessary to make full use of various means such as network anti-virus software, firewalls, and intrusion detection to effectively prevent and eliminate harm. Virus Detection and Removal: This virus will have the following characteristics, if the user finds these characteristics in the computer, it is very likely to be infected with this virus

1.The virus will send a UDP packet with a packet length of 376 bytes to port 1434 of the SQL Server server, and exploit the SQL Server vulnerability to execute the virus**. 2.

The virus can severely congest the backbone network and cause a denial of service on the SQL Server 2000 server, manifesting itself as a situation where users are unable to log in to the section**. 3.If you find all or some of the above phenomena in your computer, you are likely to have fallen for the "2003 Worm King" (virus).

3.If you have Rising Network Edition, please upgrade to the latest version, then turn on memory monitoring, and perform network-wide memory antivirus. 4.

Users with a firewall can set the firewall or router to prohibit external access to UDP port 1434 and internal and external UDP port 1434.

Resources.

Cybersecurity experts recommend that users disconnect the network and turn on the phone, that is, unplug the network cable before turning it on, so as to basically avoid being infected by ransomware. After booting up, you should find a way to apply security patches or install defense tools launched by various network security companies to connect to the Internet. It is recommended to back up the important files and data in the computer to the mobile hard disk and USB flash drive as soon as possible, and save the disk offline after the backup, and at the same time be vigilant against unknown links, files and emails.

Temporary Solution:

1. Turn on the system firewall.

2. Use the advanced settings of the system firewall to block the connection to port 445 (this operation will affect the service that uses port 445).

3. Turn on the automatic update of the system, and detect the update for installation.

Win7, Win8, Win10 process.

1. Open Control Panel - System & Security - Windows Firewall, and click on the left side to start or disable Windows Firewall.

2. Select Start Firewall and click OK.

3. Click Advanced Settings.

4. Click Inbound Rule to create a new rule.

5. Select the port, Next.

6. For a specific local port, enter 445 and go next.

7. Select Block Connection, Next.

8. Profile, Select All, Next.

9. The name can be entered arbitrarily and completed.

The process flow of the XP system.

1. Open Control Panel, Security Center, Windows Firewall, and select Enable.

2. Click Start, Run, enter cmd, and confirm the execution of the following three commands: net stop rdr, net stop srv, net stop netbt