Trying out Norton Personal Firewall

Well I decided to give norton a try to see how their Personal Firewall performs. So far i'm quite satisfied. It was very easy to set it up (great for beginners) and it is doing its job. It has blocked about 20 attacks on my computer since yesterday and it comes with a build in /whois and IP tracer which seems quite accurate. What surprised me the most though was not the firewall...but this:

Details: Trojan attempt detected from address 63.187.232.5 by rule "Default Block Backdoor/SubSeven Trojan horse".
Blocked further access for 30 minutes.

I see my firewall flashing a warning sign...and I'm wondering "WTF?!?". ROFL someone actually tried to send me a subseven...When are kids going to learn? I called up the sysadmin...but she wasn't available (Answering machine picked up)..didn't wanna bother the poor woman too much...she prolly has other crap to take care of other than my silly subseven complaint. Mostly I wanted to see if anything would get done...i've never called one of them up to complain before...i just wanted to know if someone gives a **** out there. Anyone with a personal experience please share :)

I'd actually recommend this firewall...seems pretty decent. I used ZA and wasnt too happy with it...I guess it was too complicated for my lazy brain to figure out how to set up the rules...and to tell it which programs to allow ahead of time. Now that I think about it...I was probably too lazy to check out the Help feature LOL :D

Cheers

Please share your opinions and experiences about Norton's Personal Firewall. I guess using it with Nortons SystemWorks makes a pretty good duo :)

Thats all I use is Norton Firewall.

It gives me the customization that I want, and has a good rule set for attacks.

It also has pretty decent logs as well.

The logs are very well presented compared to a few other firewalls i've tried out...easy to understand even for a basic user. Cheyenne....are u the one trying to send me a subseven?????LOL :D...i had someone trying to break into my computer from Rio De Janeiro...or prolly routing from there :)

The subseven attack came from washington...and had a quite a few attemps from cambridge...which is 10 minutes away from my house. Probably some skiddies doing a scan around the network (they were using same ISP as me)

Quote:

---

Attempted Intrusion "URL_Directory_Traversal" from your machine against 65.93.89.250 was detected and blocked
Intruder: localhost(4118)
Risk Level: High


Attempted Intrusion "BAT_Execution_Via_HTTP" from your machine against 65.93.89.250 was detected and blocked
Intruder: localhost(4115)
Risk Level: Medium
Protocol: TCP
Attacked IP: 65.93.89.250
Attacked Port: http(80)


Intrusion: Invalid Destination IP Address
Intruder: 208.180.47.89
Risk Level: Low
Source IP address: 208.180.47.89
Destination IP address: 0.0.0.69. This IP address is invalid.
Protocol: TCP.

---

Part of my logs lol

and yes I know thats my IP, but its dynamic. lol

so pretty much your computer hates you and wants to kill itself?

I had one problem with Norton products, price.
just that. seriously.

Symantec's Norton™ Personal Firewall 2004 keeps hackers out and personal data in. It makes robust firewall protection easy by automatically hiding your PC on the Internet and blocking suspicious connections. Norton Personal Firewall also protects your privacy by preventing confidential information from being sent out without your knowledge.

• NEW! A Web assistant lets you block ads and access other program options from Microsoft® Internet Explorer.

• NEW! Network Detector lets you define firewall settings for different networks, then automatically switches to the proper settings for the network you're using.

• NEW! Includes product activation procedure to ensure authenticity.

• LiveUpdate™ automatically checks for new protection updates when you're online.**


for $50 I think its worth it. Another down side for norton is that it uses a ton of resources at times...and its outoscan has a mind of its own sometimes...and it doesnt mind that you're in the middle of a Counter-strike scrimm.

Quote:

---

I see my firewall flashing a warning sign...and I'm wondering "WTF?!?". ROFL someone actually tried to send me a subseven...

---

They didn't try to send it to you.
They were just scanning for machines that have sub7 installed.

I use NIS too. Its pretty good. I use it as a backup. (cisco as my boarder router/firewall)
I like the features of it and how it is all integrated. I really like it mostly for virus protection and program control. I don't see many intrusion attempts... because they are all blocked at the boarder router/firewall. Any of the attempts that are in my logs were caused by me.

coolfuse: I agree with ya. I wish they were a bit cheaper.

cheyenne1212: was that you I saw on the Wolf ET "south bunker" server the other day?

No I still have yet to play ET phish, but we still have a CS server up @ 69.93.94.74:27015

And in a few days, I will have a Battlefiedl 1942: Desert COmbat sever up.

well i have been using ZA pro and it has done a pretty good job i think.........lol but not sure what settings to use. i had something try to get in it said something like a netbios what was that??????????? but it blocked it

I still use Norton internet security 2002 although i have updated to the latest anti virus which does seem to be much more thorough than the earlier version.

I use a router now also so i don't get the 50 odd attemps to connnect showing up on the log anymore. But i changed isp from aol to tiscali and where i was being scanned for sub7 and others a rediculouse amount of times. The router logs show the occational scan only now. Still ever with the router doing what seems to be a good job i use norton firewall to control what connects out of my pc.

I get hit approx 3 or 4 times a day with a request ?? to install a 'Phinneas Phucker' trojan.
NAV 2004 NetSec puts up the alert, and allows me to see who /where the attack is coming from, it's a geography lesson every day. Taiwan, USA, Canada, PacRim, EEC the list goes on. NAV stops them dead, which is lucky for me, as my set up knowledge is poor on a good day ?? As for the price, $60 would be nice in the UK, where I paid £60 ($90 ish) But overall I am happy with the performance so far. Although I don't have any experience of other systems, I would have to credit the NAV product for doing exactly what it says on the pack (British TV advert humour ??)

My condolences to you all. Good luck though. Really.

:thumbsup:

hehehe

Quote:

---

Mostly I wanted to see if anything would get done...i've never called one of them up to complain before...i just wanted to know if someone gives a **** out there.

---

Don't even waste your time contacting ISP out of the US. If you live in the US for example. It seems as if a dsl box is a nice bot to own. The majority of the scans I receive are from india, and various places in Europe.

Funny thing however, when I throw some **** back at them 7 out of 10 of them have open ports. Like the classic 12345, 666, 6969, and a few others. Stuff like BO, Netbus, and subseven. It might suprise you how often you get scanned for a trojan by a box already owned by the same or a even different trojan.


If you are gonna use Windows, Norton is about your best bet. It might be a bit costly, but you get what you pay for. With windows and the "user friendly generation" you have the luxury of paying for everything.

2 cents.


Be safe and stay free

I've just been hit (again) with an EMail + attachment.
NAV NetSec 2004 has deleted the attachment, and left me a message
telling me so. Pretty cool really, straight from the box, with no input from me, bar the initial set-up routine. So I'm still a happy bunny ? Even though I've had my share of problems in the not so distant past.

ARIGHTY....:) Well I just had cheyenne pound my firewall with whatever he could find...but to no avail. These are the tools he used: LanGuard, and some other ones that he couldn't tell me at the time cuz he went offline. Probably he will post them here.

Languard was very noisy...and the firewall alerted me of its presence. It also told me the name of the hotel and the address that cheyenne was staying in...for his network convention ;).

Also had jarrod try the same with some of his tools...still none of them could break in. I'm not going to make this an open hunting season lol...so don't ask me for my IP to try to hack it LOL.


Jarrod's going to try some stronger tools later on when he gets a chance :)

Cybr1d: Did you have autoblock turned on?

I'm staying in a hotel this weekend too... and some kiddie was trying to get in my laptop. NIS blocked them rather quickly. Though, since this hotel uses dhcp, he just changed IP addresses. Rather annoying actaully. I used nbtstat just to find out a bit about his machine and found out they had the messenger service running. I sent him a nice little "friendly" messege telling them that I knew that they were up to. It stopped right away. :)

LOL well the firewall its enabled...autoblock is on by default (i guess) or else it would defy the purpose. I'm using a router and a firewall though...so half the crap gets dropped at the router...and then whatever is left goes to the firewall. I need to learn more about how you found his messenger service and how u send him a msg. :)

you can find out some info if they have netbios enabled and not blocked.

from a command line

Quote:

---

C:\Documents and Settings\user>nbtstat -a 192.168.xx.xx

Local Area Connection:
Node IpAddress: [192.168.xx.xx] Scope Id: []

NetBIOS Remote Machine Name Table

Name Type Status
---------------------------------------------
COMPNAME <00> UNIQUE Registered
WORKGROUP <00> GROUP Registered
COMPNAME <03> UNIQUE Registered
USERNAME <03> UNIQUE Registered

MAC Address = 00-0D-xx-xx-xx-xx

---

In the above example, I enabled my netbios and messenger for this.
The kiddie is no longer online. :(

You see the name, type and status.

You can lookup the hex codes to see what services they have open and running.

http://www.cotse.com/nbcodes.htm

We see that <03> is the messenger service.

Using the net send command, we can send them a message.

Quote:

---

net send ipaddress message

---

Nothing fancy really...

I'd be a little concerned that only "half" the crap is stopped by your router...

Mine stops everything and I have NIS just as a backup. Hotels, etc.
I've never seen an attack that didn't get initiated by me on my private network.
It all gets blocked at the router. :) NIS is JUST for backup.

I said half as a generalization....I actually do not know for sure how much it blocks...all I know is that nothing is getting through...and all my ports are in stealth mode. Thnx for the information...it will prove very useful when I actually need to use it. :)