Link to home
Start Free TrialLog in
Avatar of Elton Brown
Elton BrownFlag for Canada

asked on

Norton Internet Worm Protection has detected and blocked an intrusion attempt.

Here are the details:

    Intrusion : Portscan.
    Intruder : 192.168.0.1(domain(53)).
    Risk level : medium
    Protocol : UDP
    Attacked IP : USER-COMPUTER(192.168.0.100)
    Attacked port : 1170
 
When I received this alert, Norton (I think) blocks all communication. The only remedy that I have found is to turn off the computer and restart!

I know that when I receive this notice at another client's computer. I discovered that the Internet Worm Protection | Autoblock rules were not turned on.

In this case Internet Worm Protection | Autoblock rules are turned on. I have done several searches and I have found anything really interesting. Any assistance is greatly appreciated!

The computer in question is using XP SP2 with a D-Link router DI-604

Thanks!
Avatar of j_h_o
j_h_o

The 'intruder' that Norton has decided to block is your own router.
This is DNS traffic; when your computer goes out and looks up a DNS name, the traffic coming back in is being blocked.

Add the router to your trusted IP list.  Make sure that your 'local network' is defined properly in Norton - it should realise that 192.168.0.1 is an internal IP and not be filtering traffic.

During these outages, try pinging other machines:
Start, run, cmd
ping 192.168.0.1
ping 192.168.0.100-101, etc (if you have other machines in the network.)
Not quite sure if it's blocking all traffic, or just your DNS traffic, thereby stopping your web surfing from working.)
norton's worm protection stinks.
it randomly alerts on a networked database and application we use... maybe once a month it would kick up an alert and prevent the user from getting to the database.  real pain in the rear.
my best advice is to uninstall it.
you really only need an antivirus, strong realtime antispyware program and firewall (as long as you use safe surfing habits).  if you are in the habit of downloading illegal programs that contain viruses, or opening email attachments from people you don't know, then you may just have to suffer with norton's crapware.
Agreed =)

I use F-Secure Client Security on the 500+ machines I manage.
Or... nothing at all.

Login as a regular (non-Power, non-Administrator) user, and you really can't do that much damage to your computer, if you're behind a firewall and don't click on stupid links.

Norton is causing you more headaches than it's worth.  You're behind a router already. =)
ASKER CERTIFIED SOLUTION
Avatar of j_h_o
j_h_o

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
SOLUTION
Avatar of Rob Williams
Rob Williams
Flag of Canada image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of Elton Brown

ASKER

I don't find their support {Symantetc) to be very good either. As the Norton subscribtions die on my machines I have been ripping out Norton and installing Avast. So far none of the machines that are currently running Avast are having any problems (knock-on wood). At least the Avast anti-virus software is free.

I refuse to pay for a product and then have to beg for support. ENOUGH Symantec bashing! :( Sorry!

zephyr_hex , this is what makes this situation so sad they are/I was running just Norton Antivirus. OO don't get me started!
What I am going to do is get rid of Norton all together and use Avast. For the past two days I have tried to connect with Norton support - I can't get through via the telephone!
Thanks cdplayer. Good luck.
--Rob