Networks

Ask something
Question Locked

Firewall security logging

0 helpful
7 replies

by benzionk

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hi,

I have a problem that from time to time infected files are created in my PC. My antivirus immediately deletes it but later these files are created again and again. I noticed that when my PC is disconnected from Internet it doesn't happen.

Usually these are files infected by "Brontok.CV worm".

I suspect that there's somewhere a "hole" in my firewall and/or some application "imports" these infected files.

I tried to compare the time when the infected file was caught and the Firewall security logging timestamps.

The problem is that the firewall security logging doesn't show what application opened the connection. How can I get this information to find the hole in my firewall?

7 replies

by computercookie

What you've done is you've allowed inbound traffic via an internet webpage or download.

As usual this them replicates itself on your computer, what you need to do is turn off system restore, scan your computer with Anti-Virus and Spyware programs running in safe mode.

Download a copy of Zone Alarm Free and hopefully in the clear, then turn on system restore.

Any questions post back.

Jeff

by benzionk

Hi,

How can I "turn off the system restore"?
How can I block the inbound trafiic.

Thanks.

by cmiller5400

In the system section of the control panel, there should be a system restore tab. Disable it there. Blocking inbound traffic requires a firewall, the free version of ZoneAlarm is quite good.

by benzionk

OK. I did all you recommended. Antivirus scan in Safe mode found nothing. But the AlarmZone Free that I installed seems to do his job. For last 5 days, thanks G-d, no infected files intruded my PC.

Thanks.

This discussion is closed to new replies.