Didn’t he also disable the built-in firewall? His “experiment” seems disingenuous when he goes out of his way to hobble the operating system to achieve the result for which he is looking. If a computer were running the last known good/patched version of XP with its firewall enabled AND a default firewall on a home modem/router enabled, and then that computer was just connected to the internet with no user activity on it, I highly doubt it would get infected to the point of the one in his “experiment”.
Latest Answers