Well this is getting way off topic which is why I didn't go into it at first, but since your so curious to know why Windows Firewall is a security hole. There's a lot of hacker tricks out there to easily get around it, it doesn't protect all areas and sometimes just gives a false sense of security. It's designed with the principle 'the firewall should keep out unsolicited traffic', so it's not a flaw as such just a hole.
For example:
Let's use Vista (since you love it) with the standard Microsoft firewall turned on and use a basic third-party FTP client.
Let's use a command line one and rename under Windows/System32 to be called FTP.exe
Now under the command line we'll use it to connect to any old ftp server, for example: ftp ftp.microsoft.com
After you see the "220" greeting message, enter ftp as the user - press enter.
Now you're prompted for a password - enter anything and press enter.
Once you're logged on, enter dir - again, press enter.
You'll see the directory listing succeed, but you'll also see a warning that a connection is being blocked.
At the same time of telling you to block the connection, it allows it through, woah security hole?
What's more, even if you specify Keep Blocking, and then go issue another dir command, that one succeeds, bigger hole?
Let's go look at the Windows Advanced Firewall Rules for Inbound, and see if this sheds any light.
The first copy is set to block any listening ports opened but the second is fully open even if you tell it to be blocked. Deleting both sets of rules doesn't make a difference, it will keep doing it.
The FTP client knows that it needs to open a data connection.
To start the data connection, the FTP client binds to a port, and starts listening.
The firewall says "Oh no, an unknown program has started listening - better warn them that they won't get any traffic."
The FTP client checks what port it actually got, and sends a matching PORT command.
The connection inspection engine says "PORT command? That's my cue!" and opens a hole in the firewall to incoming data connections.
Microsoft trusts itself and there's the hole - using it against itself.
Okay, apart from the obvious - that if a hacker could connect out to a server on port 21, nothing's stopping that hacker from transferring data in.
Finally, is this a vulnerability, a hole, or anything outside the correct operation of a firewall Microsoft should fix? No, because the firewall is documented as blocking unsolicited incoming connections - and by any reasonable definition, the data connection requested by a PORT command is solicited.
Source? How about Microsoft - Alun Jones ( Security MVP )
I suggest getting a third party firewall, which doesn't even trust itself.
As for so-called bad system cleaning applications? Advanced SystemCare it cleans privacy/cookies/junk files, adds an extra layer of security on your web-browser and OS, restricts known bad websites, dialers, etc, checks for hi-jacked settings, and removing basic spyware (yes okay it won't cover the anti-virus's job, neither does Microsoft Windows Defender for that matter and it's the same deal). I don't think it's half the bad application you make it out to be. I would suggest to use it manually though - it also scans registry, etc, but your got full control of that under the options. For a safety feature on the advance scannings it also backups and add a second boot, if the first ever fails you can recover instantly from the second.
