Results 1 to 8 of 8

Thread: Solve Security Issues in Windows XP

  1. #1
    Junior Member
    Join Date
    May 2006
    Posts
    11

    Thumbs up Solve Security Issues in Windows XP

    Solve Security Issues in Windows XP
    by Ron

    WARNING: Please create a system restore before even thinking about doing this tutorial. To run a system restore click on Start > Program > Accessories > System Tools > System Restore > Create a Restore Point.

    Sorry for all the people that have XP Home and not the Pro version. Turns out if you give Microsoft more money they will include more security features in the Microsoft OS, but won't turn them on because they are *******s lol. Anyways, all the Categories for each listing says if it's for XP Pro Only or XP Home/Pro which means for both.

    One last note: All these categories have been tested on numerous computers of mine, my parents, and a few friends. They all work if executed correctly. Please be very careful. Also, if you don't understand something such as why blah blah could be a vulnerability in your computer, then just google it. Such as for ICMP. Go to google.com and search for ICMP Vulnerabilities and click on oneof the links and read it. It's that simple! Now for the tutorial.

    -> First Step is to Backup Registry - XP Home/Pro
    • Go to Start > Run > regedit > Right click on My Computer > Export
    • Call the file Registry_backup and save it some place you remember. Such as... In a folder on the desktop called My Stuff or something.
    • Click Save and now you have a backup of your entire computer's registry!


    -> Network Connection Security - XP Home/Pro
    • Go to Start > Settings > Control Panel > Network Connections > Right click on Local Area Connection 2 > Click on Properties.
    • On the General Tab, uncheck every checkbox except for Internet Protocol (TCP/IP).
    • Now click on Internet Protocol (TCP/IP) and click on Properties.
    • On the General tab, click on Advanced at the bottom. Advanced TCP/IP Settings should pop up.
    • Click on the Options tab, then click on TCP/IP Filtering and click on Properties.
    • Uncheck Enable TCP/IP Filtering (All Adapters).


    -> Closing ICMP Protocol and a few others - XP Home/Pro
    • Go to Start > Run > regedit > HKEY_LOCAL_MACHINE > SYSTEM > CurrentControlSet > Services > Tcpip > Click on Parameters, but do not click on the +.
    • Double click on EnableICMPRedirect, which is on the right hand pane when you have clicked on Parameters.
    • Once you double click on EnableICMPRedirect, change its value to 0.
    • Make sure to also change the values of EnableDeadGWDetect, EnablePMTUDiscovery, and PerformRouterDiscovery to 0.
    • While you're in Parameters, make sure to change the values of EnableDeadGWDetect, EnableSecurityFilters, and NoNameReleaseOnDemand to 1.


    -> Closing DCOM Protocol - XP Home/Pro
    • Go to Start > Run > regedit > HKEY_LOCAL_MACHINE > Software > Microsoft > Ole
    • Double click on EnableDCOM and set it to N. If the key doesn't exist, then create it by right clicking and clicking on New > String Value. Click on the new one you just made and press F2 to rename it to EnableDCOM.
    • Go to HKEY_LOCAL_MACHINE > Software > Microsoft > Rpc
    • Double click on DCOM Protocols and remove ncacn_ip_tcp only!
    • Go to HKEY_LOCAL_MACHINE > system > CurrentControlSet > Services > Dnscache > Parameters and double click on MaxCachedSockets and change its value to 0. If it doesn't exist, create one by right clicking and clicking on New > DWORD Value. Click on the new one you just made and press F2 to rename it to MaxCachedSockets.
    • Go to HKEY_LOCAL_MACHINE > SYSTEM > CurrentControlSet > Services > NetBT > Parameters and click on SmbDeviceEnabled (REG_DWORD) and set its value to 0. If it doesn't exist, create one by right clicking and clicking on New > DWORD Value. Click on the new one you just made and press F2 to rename it to SmbDeviceEnabled.


    -> Tightening "Restrict Anonymous" Holes - XP Home/Pro
    • Go to Start > Run > regedit > HKEY_LOCAL_MACHINE > SYSTEM > CurrentControlSet > Control > Click on Lsa, but do not click on the +.
    • Double click on restrictanonymous and change it to 2.
    • Double click on restrictanonymoussam and change it to 1.


    -> LanMan - XP Home/Pro
    • Go to Start > Run > regedit > HKEY_LOCAL_MACHINE > SYSTEM > CurrentControlSet > Services > lanmanserver > Parameters.
    • Double click on NullSessionPipes and erase everything in it.
    • Double click on NullSessionShares and erase everything in it.
    • Click on lanmanworkstation and do the same if there is NullSessionPipes and NullSessionShares.
    • Make 2 new keys in lanmanserver (not lanmanworkstation) by right clicking on Parameters > New > DWORD Value > Change its name to AutoShareServer and make the other one AutoShareWks. Both their values should be set to 2.


    -> User Accounts - XP Pro Only
    By default, the Guest account password is blank. Make it something difficult, such as a combination of letters and numbers, preferably not based on dictionary words.
    • Go to Start > Settings > Control Panel > Administrative Tools > Computer Management > Local Users and Groups > Highlight User Account > right-click and click on Set Password.
    • Remove/Delete any unused accounts, especially any 'remote assistance' accounts.
    • Disable the Guest account since you can't delete it.
    • Go to Start > Settings > Control Panel > Administrative Tools > Local Security Policy > Local Policies > Security Options Account > Rename Guest Account - Double click and rename the account to something weird like Fa98sasjd9as (this is where the weirdo leet language comes into play, but only here).


    -> Remote Machines - XP Pro Only
    If you do not need to connect to your computer from a remote machine, be sure to turn this off.
    • Go to Control Panel > Administrative Tools > Local Security Policy > Local Policies > User rights Assessment > "Access this computer from the network" and then delete all users and groups. This should now be blank.
    • Click on "Deny access to this computer from the network" - this should include all users and groups. Double click on the policy, click Add User or group, click Advanced, click Find Now, highlight all the accounts and click OK.
    • Under System Properties > Remote > Turn off Remote Desktop and Remote invitations


    -> Change Remote Scheduled Tasks - XP Home/Pro
    Instead of having to wait for the remote scheduled tasks, which is useless information to anyone who is not a system administrator remotely configuring scheduled tasks, you can disable this feature.
    • Go to Start > Run > regedit > HKEY_LOCAL_MACHINE > Software > Microsoft > Windows > CurrentVersion > Explorer > RemoteComputer > NameSpace
    • In the NameSpace folder you will find two entries. One is "{2227A280-3AEA-1069-A2DE-08002B30309D}" which tells Explorer to show printers shared on the remote machine. The other, "{D6277990-4C6A-11CF-8D87-00AA0060F5BF}", tells Explorer to show remote scheduled tasks. This is the one that you should delete.
    • If you have no use for viewing remote shared printers and are really only interested in shared files, consider deleting the printers key, "{2227A280-3AEA-1069-A2DE-08002B30309D}", as well. This will also boost your browsing speed.


    -> Disable Posix and OS/2 - XP Home/Pro
    • DO NOT USE REGEDIT! Go to Start > Run > regedt32
    • Find HKEY_local_machine\system\currentcontrolset\Control\Session Manager\SubSystems
    • Click on SubSystems Folder, but don't click on the Plus button, just click on the folder.
    • Double click on the multistring called Optional in the right-hand pane. By default, the multistring's value will be POSIX;
    • Delete that value and leave the space empty, but don't delete the Optional multistring.


    -> Firefox, an alternative to Internet Explorer - XP Home/Pro
    This program is the best web browser on the internet and clears soooo many holes by using this browser instead. Plus it has many positives and few negatives, while Internet Explorer has many negatives and few positives.

    -> Disable Crappy Services we don't need - XP Home/Pro
    Open up services.msc by going to Start > Run > "services.msc" without the quotation marks. Disable the following services and click on the button Stop if they are running.
    • Automatic Updates - Though, you still need to do windows updates, but you don't need a process running all the time, slowing down your computer. Just do it by hand by going here.
    • Alerter
    • Clipbook
    • Computer Browser
    • Error Reporting Service
    • FTP Publishing
    • Help and Support - Put this on manual
    • Human Interface Device Access - This is recommended for people with usb mouse or keyboard, without it, it wont work!
    • Indexing Service
    • Messenger
    • NetMeeting Remote Desktop Sharing
    • Network DDE
    • Network DDE DSDM
    • Performance Logs and Alerts
    • Protected Storage - This saves passwords. You should never save passwords, but leave this on incase you still do. Evenif it does leave secuirty holes and your passwords up for grabs...
    • Remote Desktop Help Session Manager
    • Remote Registry
    • Routing and Remote Access
    • Secondary Logon
    • Security Accounts Manager
    • SSDP Discovery Service
    • Telnet
    • Universal Plug and Play Device Host


    -> REBOOT YOUR COMPUTER
    Once brought back up do the following:
    • Check to see if your internet works.
    • Check to see if you can have other programs connect to the internet.
    • If you can't, then post in this topic for help. I'll be able to figure your problem and help you find a solution.


    -> Windows Updates - XP Home/Pro
    I can't stress this enough. You NEED to do windows updates. Microsoft sucks so much, but everytime they issue out a patch or whatever, download it immediately. Every now and then just check for Windows Updates by clicking here or going to your Start Menu and clicking on Windows Updates right above Programs. If there are any updates to install, download and install them, and then reboot your computer.

    Quote Originally Posted by Doctor Ron
    Don't be lazy.
    Don't be late.
    Keep your Computer, up to date.
    -> Run Online Security Checks - XP Home/Pro - Use IE for this only. Sorry Firefox fans.


    Aftermath: YAY! Your computer should be much faster, much safer, and just much much better! Tell all those pesky hackers to **** off! Great job, and I hope to add more security tweaks in this topic. The changelog for this tutorial is in the next post. Once again. Great job!

    - - - - - - - - - - - - - - - - - - - - -

    Want to Tweak your computer even more? Click Here.
    Note: Some tweaks were from the website I just mentioned. Although almost all of them (95%) are from users on their forums. They haven't been tested completely and are written like crap. These tweaks are the best working ones for overall computers and so far I have gotten no issues with them.

    ~Ron
    Last edited by RonTheCon; 2006-05-28 at 15:38. Reason: Added more information

  2. #2
    Junior Member
    Join Date
    May 2006
    Posts
    11

    Default

    Change Log
    --------------------------------
    05/28/06:
    - Added a One Last Note before the tutorial began so you know what you're changing.
    - Added a more appropriate reboot information which doesn't scare the crap out of people.
    - Added First Step is to Backup Registry category.

    05/27/06: Tutorial Added.
    Last edited by RonTheCon; 2006-05-28 at 07:49.

  3. #3
    Member of Team Spybot tashi's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    30,955

    Default

    Hello.

    I moved your topic back to Alerts, we do not have forums this kind of post might be appropiate in.

    Quote Originally Posted by RonTheCon
    REBOOT YOUR COMPUTER. If everything works! Then come back to this page and continue! If it doesn't, go over what you did or post here for help.
    Excuse me?
    Microsoft MVP Reconnect 2018-
    Windows Insider MVP 2016-2018
    Microsoft Consumer Security MVP 2006-2016

  4. #4
    Security Expert Corrine's Avatar
    Join Date
    Oct 2005
    Location
    Upstate, NY
    Posts
    62

    Default

    Hmmmm, interesting, but I wonder about a few things.

    It would be a good idea to expand on the instructions for creating a restore point. Not everyone knows how to do that.

    How about instructions on backing up the registry? Regedits by those not experienced in moving around in the registry can be disasterous. One false edit and that's a pretty expensive paperweight.

    You're saying these actions will solve security issues. What issues are they solving? Someone making these changes will have a false sense of security if they think their PC is protected.

    This is a SBSD Support forum, not a Windows Security Forum. This might be more appropriate in a Windows site or on your own website or blog, particularly with the comment:

    REBOOT YOUR COMPUTER. If everything works! Then come back to this page and continue! If it doesn't, go over what you did or post here for help.
    If everything works! Oh my! And if it doesn't work, will there even be a connection to the internet? The changes you recommend are not for a novice. It certainly would help to have an explanation of what those changes are that you are suggesting and what they will do. I don't recommend blindly making changes to a PC unless you understand what those changes are and what they are for.
    Windows Insider MVP * * * Microsoft MVP, 2006-20016

    Take a walk through the "Security Garden" -- Where Everything is Coming up Roses!

  5. #5
    Junior Member
    Join Date
    May 2006
    Posts
    11

    Default

    Lol sorry about that. What I meant was. Check to see if your internet works, check to see if you can have other programs connect to the internet, if you can't then just reverse the steps.

    The above issues clears up a lot of crappy holes in Microsoft, which Microsoft doesn't want to fix because they're still looking through our computers and trying to make sure we don't get XP or XP pro from torrents or p2p apps or whatever.

    Those settings should not conflict with anything on your computer. I have checked on 4 different comps. Mine which is XP Home, my dad's which is XP Pro, and my friends which also have XP Pro.

    Sorry for me being a little vague on the above vulnerabilities. Since there isn't a category for it, instead of not having this thread at all, why not make a section just for Windows Security? Isn't that what Spybto S&D does? It helps our security, helps us get rid of spyware. Well these settings will help prevent most spyware in the first place.

    Maybe Spybot will have these settings in their new version.

    I'm just trying to help.


    I'll add how to make a registry back up later. It's almost midnight here on the east coast. And I already explained how to make a restore point with the above instructions right next to the warning tag. How hard can that be if I already gave the steps lol?

    Err.. Thanks for moving the thread again. I hope it doesn't keep getting moved.

    ~Ron

  6. #6
    Member of Team Spybot tashi's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    30,955

    Default

    If it does get moved again you won't be seeing it anymore.

    As for Windows Security we have topics in our Malware Removal Forum which target the problems our members might need to address.
    Microsoft MVP Reconnect 2018-
    Windows Insider MVP 2016-2018
    Microsoft Consumer Security MVP 2006-2016

  7. #7
    Junior Member
    Join Date
    May 2006
    Posts
    11

    Default

    Aww please keep this thread! I worked so hard on it. :(

  8. #8
    Junior Member
    Join Date
    May 2006
    Posts
    11

    Default

    I fixed all those things you people just mentioned.

    I fixed the scary reboot message and I added how to back up your registry.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •