How does XP use the registry to build a firewall?

Windows Group Policy is actually a good "firewall" as long as you can set it up.

First, Trojan virus impersonation process protection.

svchost itself is only as a service host, and does not implement any service functions, the services that need to be started by svchost are implemented in the form of dynamic link libraries, when installing these services, the executable program of the service points to svchost, and when these services are started, svchost calls the dynamic link library of the corresponding service to start the service. Therefore, the process is essential. Usually WindowsXP systems have multiple processes, so it is difficult to detect the disguise.

We can create two new policies to prevent it. First, open the "Run" command, enter the "command" to open Group Policy, "Windows Settings" under "Computer Configuration", and open the settings of "Software Restriction Policy" in "Security Settings". (Computer Configuration and User Configuration are pretty much the same, except that the apps set in Computer Configuration apply to all users on the computer, while in User Provision, only the current user is applied.)

We set the policy in "Other Rules". Click "Other Rules" on the right side, right-click to create a new "New Path Rule", and in the pop-up window, click Browse to select the files in the system (if the system disk is C drive, the path is: C:.)

windows\system32\；The Security Level is Unrestricted. Create a new policy, enter "in the path", and set the Security Level to "Not allowed". (There's a priority issue here, as defined by Microsoft:.)

Absolute Path: Use the wildcard path" filename).

Second, block suspicious programs.

We know that the system does not have executable files in the recycled folder, system restore folder (systemvolumeinformation), system folder, drivers folder, etc. under normal circumstances. So you can create some new rules.

Also create a new one in Other Rules. Create four new rules with the following path: ?

recycled\*.exe”、“systemvolumeinformation\*.exe”、“windir%\system\*.

exe”、“windir%\system32\drivers\*.exe”。The "security level" is all "not allowed".

Third, automatic operation is prohibited.

In fact, you can also use Group Policy to disable automatic operation by entering "?" in the path:exe" and then set it to "Not Allowed".

You can also set a rule to protect against the autorun virus, enter "?" in the pathand the security level is set to Not allowed.

If you are not sure, you can create a new path rule and enter ?:com", which is also set to "Not allowed".

Hope it works for you guys!

Buy a system software with a system firewall, it seems that the depth can be done to try it! It's so difficult to use the registry, last time a friend taught me to use the registry to implement the lock program function, I remembered it at the time, and now it won't Or you** an antivirus software, it is recommended that you use Rising, streaking is not good, it is easy to get a virus, or you ** when you ** thing is best to use Thunderbolt, because Thunderbolt comes with an anti-virus system, so it is safer!

The guy upstairs said true. The landlord can go to the depth to see, that system forum provides this.

Buy a system software with a system firewall, it seems that depth can do it.

Go give it a try! It's so hard to use the registry, last time a friend taught me to use the registry to implement the locking program function, I remembered it at the time, and now I can't.

Or you** an anti-virus software, it is recommended that you use Rising, streaking is not good, it is easy to get a virus, or you ** when you ** things are best to use Thunderbolt, because Thunderbolt comes with an anti-virus system, so it is safer!

It's useless to build it yourself.,Hit the Trojan horse will automatically open the port!