PORTABLE Windows Worms Door Cleaner

[ha14]

Hi

Most of the worms, in particular the most famous, use known vulnerabilities in Windows services which are enabled by default and that often can't be disabled via the OS's configuration.
Even with these services patched with Microsoft security fixes, they are still exposed to the Internet at large ready to be exploited by the next exploit.

Windows Worms Doors Cleaner allows you to close these services the worms rely on.

These ports/services on client side are :

* DCOM RPC (listen on port 135) MS03-026
* RPC Locator (port 445) MS03-001, MS04-011
* NetBIOS (ports 137/138/139) MS03-049
* UPNP (port 5000) MS01-059
* Messenger service (uses RPC/NetBIOS ports) MS03-043


Server side services are not covered by windows worms doors cleaner which aims only home users computers, who themselves shouldn't run any webservers.These webservers should be patched and can't really be disabled without removing the service offered to the Internet (like the website).


http://rapidshare.com/files/179216770/wwdc.rar

[Solaris]

Please avoid Rapidshare links, and link it to the [url=http://www.firewallleaktester.com/wwdc.htm]official website.

[hellnoire]

Thanks guys, testing this on Vista to see if it works. If it does, it's going on my toolkit.

[Polkadot]

He doesn't want to link to the site because he copied it word-for-word onto his post:

http://www.firewallleaktester.com/wwdc.htm

[Rusty]

do you have to run this constantly or just once. What i mean is does this have to run like an AV constantly in the background

[ha14]

Yap sorry for not mentioning the web page because I made it for another forum where I had to mention the rapidshare link, so I made a mistake and paste this link here and there. But still the link works and its a freeware, thank GOD. Concerning the word to word, I choosed it since the soft its not mine and have to repect the author, but if someone else can explain it differently then I will be happy to read it. No offense to anyone.

Some firewall qre configurated to to block ports 137 (for NetBIOS name resolution), 138 (for NetBIOS browsing and logon), and 139 (for NetBIOS file and print sharing using SMB) and this to protects the network from external attackers trying to exploit NetBIOS to find out information about the sysytem. But this doesn't prevent an insider attack that uses nbtstat to enumerate the network by listing NetBIOS name tables and sessions as to further penetration. So some administrators would like to disable NETBIOS over TCP/IP entirely on Windows 2000 or later machines but they have to be sure they will not need this option for communication later on.

So this soft can do it Well it has to be checked and had to disable two ports and checked again and it works fine, apparently one time is enaugh, but this depend also on configuration.