Re: Norton Firewall

Tech-Archive recommends: Speed Up your PC by fixing your registry

From: Mario (mz.silva_at_DONTWANTSPAMmail.pt)
Date: 06/04/04 

Date: Fri, 4 Jun 2004 18:59:29 +0100

Hi Roberto,

Norton Personal Firewall is alerting you that some applications are trying
to use the Internet.
Many programs use the Internet for legitimate purposes, like Outlook to send
your email, or Internet Explorer to browse the web, or when you play a
multiplayer online game. Some programs have auto-update features, so they
try to check if there is lastest version. All that is ok. You should only
fear virus, trojans, and other "bad" programs that may be recording your
personal info and send it to other people somewhere far away. Common are
mass-malling virus that need the connection to send itself, and spyware
programs who download pop-ups and may record your web browse history.
The key to avoid troubles is prevention and safe practices, not defensive
software (antivirus, firewall, spyware detectors). Defensive software is
important, but it's a plus, and would not help much if you usually open
dangerous email attachments from people who dont know, download every
freeware you know of and install all the dialers and activex controls every
time you see one. Not running with administrator privileges is also the most
important advice for all Windows XP users. Login as administrator only to
install/uninstall programs and configure system settings. For the main
account used to common usage, go with the limited user account.

Norton Personal Firewall by default alerts and ask permission for all
connections, even outbound connections.
When a program on your computer try to access something on another computer
that's an outbound connection. Inbound connection is when another computer
try to access something on your computer. Inbound connections, initiated by
other computers are more dangerous than outbound connections. Most routers
and simple firewalls only block inbound connections.

You, like anyone else using Norton Firewall, dont want these alerts and
permission requests. So you can, and should, configure it.

Login as administrator if your account doesn't have such privileges. Run
LiveUpdate to get the latest version and patchs.
If asked to reboot, accept it, wait and run LiveUpdate again until you see
no more updates available.

Then configure it. Open main window, click on Personal Firewall and then
Configure button.
Under program control, make a program scan to detect and auto-configure many
applications.
For the remaining apps, when you see an alert you may configure it. If you
dont trust it you may block it; if there is something expected and you want
to give it permanent permission set it like that.

If you dont want the alerts and but also dont want to get into settings,
connections, ports, then you have another setting also under Personal
Firewall/Configure, that is firewall level to "Low". It's just one click to
set this. The alerts go away, and you still have the computers ports stealth
from dangerous inbound connections. It's a small trade off; any way, without
specific knowledge there is no way to make harder the machine security.

Your "items" (process names) look ok. Of course, on theory, they can be
trojan horses, but it's highly unlikely.
Only forensics, running an integrity check against known hash values can
determine for sure if they were tampered with.
I know none of such tools for newbies to play arround. But one could setup
Windows again on another computer, compute the hash digest for suspected
files with any MD5 or SHA utillity and then again on the test system. If the
values match then the files are exactly the same, if they dont, were
tampered with. Course files need to be the same version and language.

Best regards,
Mario

"Roberto" <anonymous@discussions.microsoft.com> wrote in message
news:474AD156-56C6-420A-9A37-6E8DE974C3B3@microsoft.com...
> I have recently installed Norton Internet Security and it constantly comes
up trying to block the following items:
> Svchost.exe
> msmsgs.exe
> Lucomserver.exe
> iexplore.exe
> hotsync.exe
> ndetect.exe
> zclient.exe
> explorer.exe
> msimn.exe
>
> Can anyone tell me if it is ok to allow these processes and will I ever
get norton to stop this from continuing.

Quantcast