firewall question and windows installer/spyware question

firewall question and windows installer/spyware question

Secure Home | Search | About
 Microsoft Applications Security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
firewall question and windows installer/spyware question unstablemicroso 09-24-2006
Posted by =?Utf-8?B?dW5zdGFibGVtaWNyb3Nv on September 24, 2006, 8:48 am
If you were  Registered and logged in, you could reply and use other advanced thread options
Hi. Two Questions.

I have a McAfee firewall 7.x, home version. I tried to save the log of
incoming events as an archive, but couldn't read the log. (Copy and paste
didn't work) It was an .edf file. I didn't know how to open it (Windows XP
Home Edition service pack 2 asked me how I wanted to open it ...), or even
what an .edf file is in essence.
And I didn't feel like getting some program from the web to put the log
here, you never know if there is spyware attached. And I vaguely recall that
when looking on the microsoft.com website I got the message that there was no
suitable program for my language (of Windows, or McAfee ??)

Anyway, some of the incoming events (called "unwanted attempt (IP address
mentioned) to connect to
port x") seemed harmless, others definitely did not, and seemed to be
related to hacking activity, spamming business or other unsavory business.
Both UDP and TCP. Some tests confirm that my router has a working firewall.

What's going on ? I have configured the firewall for a home network, do not
trust home network. The data goes straight from my cable modem to my router
(by cable/wire), and then wirelessly to my computer, no other computers in
network. WPA-PSK encryption is used. Don't tell me to contact the
manufacturer of my router (Sitecom), they give me the cold shoulder. McAfee
refers me to Sitecom. So how do I get that stuf in my log ?

Also, sometimes windows installer spontaneously gets activated and then
tries to install first microsoft office 2000 sr-1 cd 2 and then microsoft
office 200 sr-1 premium. At least, that's what it looks like. I can abort
this with some difficulty with control alt del (task manager ?), but I don't
know why or how windows installer becomes active. It happens relatively often
when I try to use www.m-w.com (an online dictionary). Sometimes also when
trying to access another web page. I should also add that something might be
wrong with my Windows XP service pack 2 system. I have the Registry Mechanic
from Pctools, but I get the impression that using it does sometimes more harm
than good. I do have two good anti spyware programs and a good antivirus
program, it's unlikely that a spyware program or antivirus program on my
computer is installed.

Insight/help appreciated.

Thanks.

Posted by =?Utf-8?B?UGFuZGFfbWFu?= on September 24, 2006, 12:40 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
My reply is at the bottom of your message :


"unstablemicrosoft" wrote:

> Hi. Two Questions.
>
> I have a McAfee firewall 7.x, home version. I tried to save the log of
> incoming events as an archive, but couldn't read the log. (Copy and paste
> didn't work) It was an .edf file. I didn't know how to open it (Windows XP
> Home Edition service pack 2 asked me how I wanted to open it ...), or even
> what an .edf file is in essence.
> And I didn't feel like getting some program from the web to put the log
> here, you never know if there is spyware attached. And I vaguely recall that
> when looking on the microsoft.com website I got the message that there was no
> suitable program for my language (of Windows, or McAfee ??)
>
> Anyway, some of the incoming events (called "unwanted attempt (IP address
> mentioned) to connect to
> port x") seemed harmless, others definitely did not, and seemed to be
> related to hacking activity, spamming business or other unsavory business.
> Both UDP and TCP. Some tests confirm that my router has a working firewall.
>
> What's going on ? I have configured the firewall for a home network, do not
> trust home network. The data goes straight from my cable modem to my router
> (by cable/wire), and then wirelessly to my computer, no other computers in
> network. WPA-PSK encryption is used. Don't tell me to contact the
> manufacturer of my router (Sitecom), they give me the cold shoulder. McAfee
> refers me to Sitecom. So how do I get that stuf in my log ?
>
> Also, sometimes windows installer spontaneously gets activated and then
> tries to install first microsoft office 2000 sr-1 cd 2 and then microsoft
> office 200 sr-1 premium. At least, that's what it looks like. I can abort
> this with some difficulty with control alt del (task manager ?), but I don't
> know why or how windows installer becomes active. It happens relatively often
> when I try to use www.m-w.com (an online dictionary). Sometimes also when
> trying to access another web page. I should also add that something might be
> wrong with my Windows XP service pack 2 system. I have the Registry Mechanic
> from Pctools, but I get the impression that using it does sometimes more harm
> than good. I do have two good anti spyware programs and a good antivirus
> program, it's unlikely that a spyware program or antivirus program on my
> computer is installed.
>
> Insight/help appreciated.
>
>


I bet we have seen almost the same message just like yours here in MS
newsgroups which has previously been answered very well . If you are the same
guy , please don't do it again !

Anyway ... from what you write I think there is nothing to worry about .
McAfee is right , their firewall is doing its job , we can't be sure about
the router . Make sure you configure it correctly to no exceptions , NAT and
SPI enabled .

Configure well your McAfee firewall to be well protected . Remember that
your software firewall (McAfee) is your MOST IMPORTANT protection , it is
protecting your computer , the router is protecting the network (if you have
such) .

Make sure your antivirus is good and always enabled , updated and well
configured .

After that , test your firewall protection with McAfee's Hackerwatch org
(search for it in Google) . Learn how to protect your computer here:
http://pandaman.my.contact.bg/Protect_your_PC.htm
http://www.microsoft.com/protect


Oh , yes , I almost forgot, your issue with MS Installer , office is not a
security issue , something wants Office applications and tries to install and
additional component which your Office still doesn't have


Regards!
--
Panda_man
Bronze level Contributor

Posted by =?Utf-8?B?dW5zdGFibGVtaWNyb3Nv on September 25, 2006, 8:04 am
If you were  Registered and logged in, you could reply and use other advanced thread options
Ok, thanks, I got my answer.

No further replies needed.

"Panda_man" wrote:

> My reply is at the bottom of your message :
>
>
> "unstablemicrosoft" wrote:
>
> > Hi. Two Questions.
> >
> > I have a McAfee firewall 7.x, home version. I tried to save the log of
> > incoming events as an archive, but couldn't read the log. (Copy and paste
> > didn't work) It was an .edf file. I didn't know how to open it (Windows XP
> > Home Edition service pack 2 asked me how I wanted to open it ...), or even
> > what an .edf file is in essence.
> > And I didn't feel like getting some program from the web to put the log
> > here, you never know if there is spyware attached. And I vaguely recall that
> > when looking on the microsoft.com website I got the message that there was
no
> > suitable program for my language (of Windows, or McAfee ??)
> >
> > Anyway, some of the incoming events (called "unwanted attempt (IP address
> > mentioned) to connect to
> > port x") seemed harmless, others definitely did not, and seemed to be
> > related to hacking activity, spamming business or other unsavory business.
> > Both UDP and TCP. Some tests confirm that my router has a working firewall.
> >
> > What's going on ? I have configured the firewall for a home network, do not
> > trust home network. The data goes straight from my cable modem to my router
> > (by cable/wire), and then wirelessly to my computer, no other computers in
> > network. WPA-PSK encryption is used. Don't tell me to contact the
> > manufacturer of my router (Sitecom), they give me the cold shoulder. McAfee
> > refers me to Sitecom. So how do I get that stuf in my log ?
> >
> > Also, sometimes windows installer spontaneously gets activated and then
> > tries to install first microsoft office 2000 sr-1 cd 2 and then microsoft
> > office 200 sr-1 premium. At least, that's what it looks like. I can abort
> > this with some difficulty with control alt del (task manager ?), but I don't
> > know why or how windows installer becomes active. It happens relatively
often
> > when I try to use www.m-w.com (an online dictionary). Sometimes also when
> > trying to access another web page. I should also add that something might be
> > wrong with my Windows XP service pack 2 system. I have the Registry Mechanic
> > from Pctools, but I get the impression that using it does sometimes more
harm
> > than good. I do have two good anti spyware programs and a good antivirus
> > program, it's unlikely that a spyware program or antivirus program on my
> > computer is installed.
> >
> > Insight/help appreciated.
> >
> >
>
>
> I bet we have seen almost the same message just like yours here in MS
> newsgroups which has previously been answered very well . If you are the same
> guy , please don't do it again !
>
> Anyway ... from what you write I think there is nothing to worry about .
> McAfee is right , their firewall is doing its job , we can't be sure about
> the router . Make sure you configure it correctly to no exceptions , NAT and
> SPI enabled .
>
> Configure well your McAfee firewall to be well protected . Remember that
> your software firewall (McAfee) is your MOST IMPORTANT protection , it is
> protecting your computer , the router is protecting the network (if you have
> such) .
>
> Make sure your antivirus is good and always enabled , updated and well
> configured .
>
> After that , test your firewall protection with McAfee's Hackerwatch org
> (search for it in Google) . Learn how to protect your computer here:
> http://pandaman.my.contact.bg/Protect_your_PC.htm
> http://www.microsoft.com/protect
>
>
> Oh , yes , I almost forgot, your issue with MS Installer , office is not a
> security issue , something wants Office applications and tries to install and
> additional component which your Office still doesn't have
>
>
> Regards!
> --
> Panda_man
> Bronze level Contributor

Similar ThreadsPosted
PPTP, PIX firewall and Windows 2000 Server question May 2, 2006, 4:10 pm
Firewall Question January 9, 2006, 4:10 am
Pix Firewall question February 9, 2006, 12:19 pm
Firewall question April 8, 2006, 7:32 pm
Firewall and DHCP question September 30, 2008, 10:23 am
windows CA question March 22, 2006, 10:09 am
Windows Defender Question(s) March 22, 2006, 9:47 am
Windows Defender question or problem? February 25, 2006, 7:40 pm
Windows 2003/Windows XP security question November 18, 2006, 12:34 pm
Windows security hotfixes install order question February 18, 2006, 9:58 pm

The site map in XML format XML site map

Contact Us | Privacy Policy