Norton Stopping

[k-liteuserintheworld]

wormless update:- her pc is now unplugged from the network and norton is currently scanning, I dont understand how something manages to get through, my pc(this one) acts as the server for the house network, it has the same norton internet security 2003 running, I also have the windows xp firewall running, I know the windows one is probably not that good but I see it as a little bit of extra protection, so how would something just go straight past my pc and get to her pc, wouldn't my firewall detect something? also wouldn't we both be attacked as we are on the same ip address?

[nikita69]

@wormless & k-liteuserintheworld - are u both on the same IP, the same PC or neither?
@wormless - if that college ip is the suspecious act, then they have been snorting ur pc. If u have another pc, download the latest updates of ur firewall & AV on a disk. install them to ur pc then run av on all hd.
@k-liteuserintheworld - u could be infected too if it's a diff pc on the same network. many people follow the step-by-step guide of setting up the network, yet fail to complete the security steps (policies, rules, user limitation or removal, etc...)

I'm not a miracle worker, yet a bit more detailed info would help, such as packet info, actions taken by snort, what were u doing before and after, etc....

[wormless]

Originally posted by nikita69@30 October 2003 - 07:49
@wormless & k-liteuserintheworld - are u both on the same IP, the same PC or neither?
@wormless - if that college ip is the suspecious act, then they have been snorting ur pc. If u have another pc, download the latest updates of ur firewall & AV on a disk. install them to ur pc then run av on all hd.
@k-liteuserintheworld - u could be infected too if it's a diff pc on the same network. many people follow the step-by-step guide of setting up the network, yet fail to complete the security steps (policies, rules, user limitation or removal, etc...)

I'm not a miracle worker, yet a bit more detailed info would help, such as packet info, actions taken by snort, what were u doing before and after, etc....

ive scanned mine offline and its cleared of viros e.t.c.

which log file is it?
we have 5pcs on 1 network.
norton is up-to-date with latest definitions. 29/10/03 last update.

nortons tracker as i didnt post details. the college was:

org name: ithuca
org id: ithaca
address: s&dp, philliph hall
city: ithaca
state provence: NY
location --- where its found it has a ? it thinks syracuse.

i left pc runnin while i was at work it was only using shareaza so it cud be someone from there.as it shows ips.

8hrs 15mins later we come home and i turn monitor on and i see nortons red alert. show details yes but the tracker again wasnt working. 2hrs later i check tracker and see college. before work i was on this k-lite board and thats it. msn loaded up and i shut it down.

[nikita69]

what i think happened is this snort, if it did really happen, it disable/flooded norton av, then went about it's other steps.

do u have a fw installed? i prefer sygate, yet have a cisco hardware firewall on my main pc and in transition to convert the whole network to it (A LOT MORE PROTECTION than software) if u have fw installed, then paste the suspected ip's packets.

run av on all every pc in the network.
l

[wormless]

Originally posted by nikita69@30 October 2003 - 08:23
what i think happened is this snort, if it did really happen, it disable/flooded norton av, then went about it's other steps.

do u have a fw installed? i prefer sygate, yet have a cisco hardware firewall on my main pc and in transition to convert the whole network to it (A LOT MORE PROTECTION than software) if u have fw installed, then paste the suspected ip's packets.

run av on all every pc in the network.
l

the tracker doesnt always load up though.
ive had this b4 and so has my bf. i think i should have zonealarm running whilst out too. yes we have firewalls on all pcs norton. my bf has 2 firewalls on his. each pc had norton instaled on them 2003 waiting 4 2oo4 upgrade to come out

[nikita69]

i just wanna be clear about couple of points:
1. have u disconnected the internet on all PCs and ran the AV on all? if not do so now
2. does each pc have it's own fw?

[wormless]

Originally posted by nikita69@30 October 2003 - 08:39
i just wanna be clear about couple of points:
1. have u disconnected the internet on all PCs and ran the AV on all? if not do so now
2. does each pc have it's own fw?

all the 5pcs has its own fw as stated in other msg. my pc is the only one been scanned i will do the others now

[nikita69]

ok, let me know when ur ready and post any unusual results from AV. i may or may not be here by the time ur done, yet i'll check again.

[wormless]

Originally posted by nikita69@30 October 2003 - 08:45
ok, let me know when ur ready and post any unusual results from AV. i may or may not be here by the time ur done, yet i'll check again.

i'll do it later going bed now ok thx for your help aswell! bbl