Firewall (ICF) appears on, but is off.

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

I have XP Home, and ICF enabled. Today I've received a Virus Alarm from norton AV. NAV eliminated the file, then, a few minutes later, another Virus Alarm (a peer to peer virus). So, I decided to see what was registered in pfirewall.log. Surprise! there is not register since Feb19th, just the date when I changed my ADSL provider. Mi ICF appears to be on, but it is obvious that it is off. I confirmed that pinging my IP from other location: my ICF is not enabled, although it appears to be OK

I would like to know the following

1) Should I to change some ICF's paramethers since I changed ADSL provider? How? or
2) if is there any actualization for this ICF (I've just seen a download for a "IPv6 Internet Connection Firewall SDK", but I'm not sure if that firewall is compatible with my system
3) Should I had to restore the whole XP to repair that problem
4) Could be recomendable to forget that ICF and download zonealarm

Thanks a lot in advance. The attacks to my address today has been continuous and I'm very scare, because is a new virus and I could not find enough information on it.
 
susanita said:
I have XP Home, and ICF enabled. Today I've received a Virus Alarm from
Click to expand...
norton AV. NAV eliminated the file, then, a few minutes later, another Virus
Alarm (a peer to peer virus). So, I decided to see what was registered in
pfirewall.log. Surprise! there is not register since Feb19th, just the date
when I changed my ADSL provider. Mi ICF appears to be on, but it is obvious
that it is off. I confirmed that pinging my IP from other location: my ICF
is not enabled, although it appears to be OK.
I would like to know the following:

1) Should I to change some ICF's paramethers since I changed ADSL provider? How? or
2) if is there any actualization for this ICF (I've just seen a download
Click to expand...
for a "IPv6 Internet Connection Firewall SDK", but I'm not sure if that
firewall is compatible with my system)
3) Should I had to restore the whole XP to repair that problem.
4) Could be recomendable to forget that ICF and download zonealarm?

Thanks a lot in advance. The attacks to my address today has been
Click to expand...
continuous and I'm very scare, because is a new virus and I could not find
enough information on it.

First I would check if your firewall is really off or you are just getting
messages from a resident problem. Go here and check
http://security.symantec.com/sscv6/
 
I checked it in Symantec, and results were a total disaster: "AT RISK!" on Hacker Exposure Check (4 open ports), Windows Vulnerability Check (it showed my user name, machine number, etc) and Trojan Horse Check (3 open ports). The ICF was "enable" at the moment of test. Simmilar results were showed in test suggested by Doug Knox.

I have to point out that ICF shows "enabled" over the same connection that I am currently using

In addition, I must say that twice NAV alerts of virus were displayed yesterday at the very beggining of my session, i.e, I did not download nothing at all that could justify the virus (Outlook is disabled too, and Im not user of Kazaa, etc). By the way, virus is W32.HLLW.Rirc, which is listed in NAV site but there is no additional information

So, I guess I will follow Rehan advice first (maybe ICF is now configurated with parameters from the former ADSL provider, who knows...). If those procedures don't work, I will disable ICF and then, I will install Zonealarm...what do you think about the "blue print"

I'm not enough fluent in English, and as I am obviously not an expert in computer things, I REALLY THANK your advice (John, Doug and Rehan).

Anyway, I think it is very weird (?) that ICF doesn't work, albeit it displays a message showing is enable. Thanks to this anonymous hacker I could realize that ICF was not working. If no intromission ocurred, I had never known that, because with my former provider ICF had a huge log report....but since I installed this new connection, there is nothing, no events at all (in fact, last modification of pfirewall.log was ten days ago

Thank you again! if you have any other comment, PLEASE do i

Susanit

(I made a mistake posting the original message twice, sorry about it, but as I received different answers in each post, I will send this answer twice too, sorry again for spam the board)
 
Q. "I already use the firewall program in Microsoft Windows XP ,
so I don't need another firewall program, do I?"

A. The Windows XP firewall program is designed to block unauthorized access into
your computer. It does not block unauthorized traffic from your computer to other computers.
So why is this bad? If a virus or worm gets into your computer, it will have unlimited
access to send anything it wants to any other computer -- including personal information
about you. Most commercial firewall programs block access to and from your computer -
so even if a hacker gets into your computer, he still has to defeat the firewall on the way out.

Please visit the Firewall experts in the Firewall newsgroup:
news://msnews.microsoft.com/microsoft.public.windows.networking.firewall

--
Carey Frisch
Microsoft MVP
Windows XP - Shell/User

Be Smart! Protect your PC!
http://www.microsoft.com/security/protect/

--------------------------------------------------------------------------------------------------


|I checked it in Symantec, and results were a total disaster: "AT RISK!" on Hacker Exposure Check (4 open
ports), Windows Vulnerability Check (it showed my user name, machine number, etc) and Trojan Horse Check (3
open ports). The ICF was "enable" at the moment of test. Simmilar results were showed in test suggested by
Doug Knox.
|
| I have to point out that ICF shows "enabled" over the same connection that I am currently using.
|
| In addition, I must say that twice NAV alerts of virus were displayed yesterday at the very beggining of my
session, i.e, I did not download nothing at all that could justify the virus (Outlook is disabled too, and Im
not user of Kazaa, etc). By the way, virus is W32.HLLW.Rirc, which is listed in NAV site but there is no
additional information.
|
| So, I guess I will follow Rehan advice first (maybe ICF is now configurated with parameters from the former
ADSL provider, who knows...). If those procedures don't work, I will disable ICF and then, I will install
Zonealarm...what do you think about the "blue print"?
|
| I'm not enough fluent in English, and as I am obviously not an expert in computer things, I REALLY THANK
your advice (John, Doug and Rehan).
|
| Anyway, I think it is very weird (?) that ICF doesn't work, albeit it displays a message showing is enable.
Thanks to this anonymous hacker I could realize that ICF was not working. If no intromission ocurred, I had
never known that, because with my former provider ICF had a huge log report....but since I installed this new
connection, there is nothing, no events at all (in fact, last modification of pfirewall.log was ten days ago)
|
| Thank you again! if you have any other comment, PLEASE do it
|
| Susanita
|
| (I made a mistake posting the original message twice, sorry about it, but as I received different answers in
each post, I will send this answer twice too, sorry again for spam the board)
 
Back
Top