Need advice on SYGATE Firewall

I replaced Windows firewall with Sygate as recommended by an admin who helped me last week.

Seems to be a very good system and very thorough, but I'm a little intimidated by the processes.

1) - Every time I connect to a new source, it asks me if I want to allow, and in most cases I do because I'm going to trusted sites.

2) - However, the thing is constantly asking me for permission to allow outgoing connections (or not), so I have to look at the details and try to make sure it's something that I want….which so far it is, but that takes time.

3) - I don't know if it's coincidence, but as soon as I connected to ebay, the icon in the tray went from green to red, and has a green flashing X in it….the info tells me someone is trying to scan my computer, the locations I've checked so far are in China.

Here's the thing….I'm not sophisticated enough to understand all of what is going on here, I can't tell what's being blocked and what's not.

I am able to understand much of it, but I don't want to make any major decisions until I know more. Should I be doing something with this stuff? or just let the thing do what it does?

Any advice? I'm a little over my head here

Here's a sample of the log it's showing so far:


02/21/2012 05:18:01 Somebody is scanning your computer.

02/21/2012 05:45:55 Somebody is scanning your computer.

02/21/2012 09:38:18 Somebody is scanning your computer.
________________________________________________



2/21/2012 9:38:18 AM Port Scan Minor Incoming TCP 58.218.199.250 00-13-5F-05-F6-D9 24.102.168.44 00-13-20-48-AB-74 Leonard Roe DG1BWS51 Normal 1 2/21/2012 9:37:17 AM 2/21/2012 9:37:17 AM

2/21/2012 5:45:55 AM Port Scan Minor Incoming TCP 58.218.199.147 00-13-5F-05-F6-D9 24.102.168.44 00-13-20-48-AB-74 Leonard Roe DG1BWS51 Normal 1 2/21/2012 5:44:54 AM 2/21/2012 5:44:54 AM

2/21/2012 5:18:01 AM Port Scan Minor Incoming TCP 221.1.220.149 00-13-5F-05-F6-D9 24.102.168.44 00-13-20-48-AB-74 Leonard Roe DG1BWS51 Normal 1 2/21/2012 5:17:00 AM 2/21/2012 5:17:00 AM

2/21/2012 2:40:33 AM Port Scan Minor Incoming TCP 85.17.24.101 00-13-5F-05-F6-D9 24.102.168.44 00-13-20-48-AB-74 Leonard Roe DG1BWS51 Normal 7 2/21/2012 2:39:26 AM 2/21/2012 2:39:31 AM

2/21/2012 1:57:17 AM Port Scan Minor Incoming TCP 58.218.199.147 00-13-5F-05-F6-D9 24.102.168.44 00-13-20-48-AB-74 Leonard Roe DG1BWS51 Normal 1 2/21/2012 1:57:12 AM 2/21/2012 1:57:12 AM

2/21/2012 1:29:15 AM Port Scan Minor Incoming TCP 221.1.220.149 00-13-5F-05-F6-D9 24.102.168.44 00-13-20-48-AB-74 Leonard Roe DG1BWS51 Normal 1 2/21/2012 1:28:13 AM 2/21/2012 1:28:13 AM

2/20/2012 10:09:11 PM Port Scan Minor Incoming TCP 58.218.199.147 00-13-5F-05-F6-D9 24.102.168.44 00-13-20-48-AB-74 Leonard Roe DG1BWS51 Normal 1 2/20/2012 10:09:04 PM 2/20/2012 10:09:04 PM

2/20/2012 9:38:45 PM Port Scan Minor Incoming TCP 221.1.220.149 00-13-5F-05-F6-D9 24.102.168.44 00-13-20-48-AB-74 Leonard Roe DG1BWS51 Normal 1 2/20/2012 9:38:35 PM 2/20/2012 9:38:35 PM

2/20/2012 8:16:13 PM Port Scan Minor Incoming TCP 58.218.199.250 00-13-5F-05-F6-D9 24.102.168.44 00-13-20-48-AB-74 Leonard Roe DG1BWS51 Normal 1 2/20/2012 8:16:05 PM 2/20/2012 8:16:05 PM

2/20/2012 6:22:04 PM Port Scan Minor Incoming TCP 58.218.199.147 00-13-5F-05-F6-D9 24.102.168.44 00-13-20-48-AB-74 Leonard Roe DG1BWS51 Normal 1 2/20/2012 6:21:03 PM 2/20/2012 6:21:03 PM

2/20/2012 5:50:08 PM Port Scan Minor Incoming TCP 221.1.220.149 00-13-5F-05-F6-D9 24.102.168.44 00-13-20-48-AB-74 Leonard Roe DG1BWS51 Normal 1 2/20/2012 5:49:04 PM 2/20/2012 5:49:04 PM

2/20/2012 5:37:11 PM Port Scan Minor Incoming TCP 58.218.199.250 00-13-5F-05-F6-D9 24.102.168.44 00-13-20-48-AB-74 Leonard Roe DG1BWS51 Normal 1 2/20/2012 5:36:10 PM 2/20/2012 5:36:10 PM

2/20/2012 5:25:17 PM Port Scan Minor Incoming TCP 66.100.170.226 00-13-5F-05-F6-D9 24.102.168.44 00-13-20-48-AB-74 Leonard Roe DG1BWS51 Normal 430 2/20/2012 5:14:49 PM 2/20/2012 5:24:14 PM

2/20/2012 5:14:47 PM Port Scan Minor Incoming TCP 66.100.170.226 00-13-5F-05-F6-D9 24.102.168.44 00-13-20-48-AB-74 Leonard Roe DG1BWS51 Normal 353 2/20/2012 5:13:46 PM 2/20/2012 5:14:46 PM

2/20/2012 2:57:21 PM Port Scan Minor Incoming TCP 58.218.199.250 00-13-5F-05-F6-D9 24.102.168.44 00-13-20-48-AB-74 Leonard Roe DG1BWS51 Normal 1 2/20/2012 2:57:03 PM 2/20/2012 2:57:03 PM

2/20/2012 2:32:44 PM Port Scan Minor Incoming TCP 58.218.199.147 00-13-5F-05-F6-D9 24.102.168.44 00-13-20-48-AB-74 Leonard Roe DG1BWS51 Normal 1 2/20/2012 2:32:34 PM 2/20/2012 2:32:34 PM

2/20/2012 1:57:36 PM Port Scan Minor Incoming TCP 221.1.220.149 00-13-5F-05-F6-D9 24.102.168.44 00-13-20-48-AB-74 Leonard Roe DG1BWS51 Normal 1 2/20/2012 1:56:32 PM 2/20/2012 1:56:32 PM

Somebody is scanning your computer.
Your computer's TCP ports:
8085, 8000, 2301, and 8123 have been scanned from [removed]..

Hi, I can understand how its difficult sometimes to figure out the correct response to a query raised by your Sygate firewall.
It looks to me as though it is doing its job and blocking undesirable elements, so you can rest easy.

However this may not be enough…. as its placing upon you the onus of deciding to allow or disallow a particular application/service….. this is particularly difficult if you find yourself so short of time that looking up via your favourite search engine the service or application in order to determine if its Ok or not is too time consuming….

Many folks like the idea of being in control and setting the rules…others are happier to hand the whole thing over to the firewall and let it get on with it!

its "horses for courses"…

There is no doubt that a 2 way or bi directional firewall provides added protection, compared with the native Windows firewall within Windows XP…( as advised by Satchfan, your malware removal expert over in the other forum…) however even with a bi directional firewall your protection will be reduced if you just tell it to accept any old attempt to get into or out of your computer…. For this reason the counsel of perfection and my advice must be to continue to use a bi directional 3rd party firewall and read all you can to set the rules that it will apply to protect you and the other users of your computer. You should not allow or accept any traffic that you are not completely sure about! If in doubt then block or disallow it…

If this is not your preferred course of action then more limited protection may be obtained by using the native Windows firewall only (you should only run one firewall… running two is likely to create big problems on your computer) The native Windows firewall will just get on with its job of blocking incoming threats without asking or even letting you know….

As Satchfan explained your 3rd party firewall (Sygate or similar) monitors/blocks both incoming and outgoing traffic, whilst the native Windows firewall in XP only deals with incoming….
If I can try and put this in sort of perspective… then its a bit like:
stopping a burglar/vandal from getting into your home ( incoming protection like the native Windows firewall)
compared with:
in addition stopping a burglar/vandal from breaking his way out of your home once he has broken in ……( 3rd party bi directional firewall like Sygate.

The extra "cover" for breakouts can be useful but the best idea is to stop the bad guys getting in …..

I can't lead you as to which way you go as it must be your call…. however:
1 with a good anti virus product like Microsoft Security Essentials, kept up to date (at least daily)
2 the Windows native firewall operational.
3 Windows updates automatically installed as required.
4 Applications that have security vulnerabilities uninstalled and replaced with the latest updated and more secure versions…Java, Adobe, Flash etc.,
5 All peer to peer filesharing applications uninstalled and no files downloaded from any source where their provenance is anything less than 100%
6 with well informedand trained computer operators who know the dangers of indicriminate clicking on things they shouldn't click on….. like links in emails…. dubious web sites….and links that they have not checked (as far as they can…… (use a good search engine for this)
7 with a disc image, verified for accuracy and updated from time to time, but with the original kept safe with one copy on removable media, kept offsite together with a bootable CD that will enable you to access the disc image.

you should be able to sleep easy at night!
If for any reason you have not made a disc image then I recommend you do so immediately….. There are free applicationa that are available to download from here:
http://www.thefreecountry.com/utilities/backupandimage.shtml
(Macrium is good)
and theri are paid for applications readily available from the likes of Acronis, Paragon, Symantec etc.,
Good luck and post back if you need any clarifications
Regards
paws

To add to the above, in it's day Sygate was a leader in firewalls, unfortunately it has not been updated for many years now, and as such "could" have security holes that make it not as secure as it should\could be if still maintained by the makers, and due to this I no longer personally suggest this firewall, not because it's bad, quite the opposite, but with such outdated support there is no way to know what security issues it may have these days. The incoming reports are common, for the most part they are innocent and do no harm, it's just how the net works, I can't explain the in's and out's, but your isp will be at least one of those reports you’re getting notified about, so unless your system starts to act unusual it's not worth worrying about those reports, not unless as I say it has the feeling of something not right, and I turn off these notifications when it's possible as they will drive you mad lol. As paws said, such software is personal choice, my weapon of choice is Zone Alarm (ZA), although it still has requests such as the current firewall is asking you, it has been pre configured to allow a lot of programs without bothering you, these are well known and trusted programs\processes that are added without you even knowing, this means you get bothered a lot less, I dare say Sygate would have gone a similar way if it were still maintained, but if you read the details that come up you can often make out what program the request is coming from, and if you know it's one you use then it's safe to check the remember option, and allow all, that way it won’t bother you again until it changes, eg an update, if this hap[pens just repeat and that’s it until next time. Now there are a number of people who have a lot of trouble with ZA, personally I have only ever had 1 system just wouldn't play nice, with such systems you are forced to choose another firewall, the xp firewall is not all that, I always use a 3rd party application on xp builds, way back it was only my firewall (ZA) that warned me something was wrong, it was repeated requests from something I didn't recognise, turned out to be an infection, it hit the news it was that big, but it's why I like outgoing control as well as incoming, but like paws said, it's a case of searching files you don't know to see if they are safe or not, and it can be time consuming at first, but as you teach it things quieten down quite quickly. Bitdefender is another big name in protection, but I have little experience with this, when I tried it I found it hard work due to the control I wanted to have, but this was many years back, it may be easy now, I dare say others have other software they rate as well, but as said above it's very much a personal thing, but my advice is try out some other choices and see which you get on with the most, hope this helps a little anyway.

Hi,

I don't use Sygate but the first log looks like a port scan attack and as Sygate is reporting it means that it is doing it's job. Someone may be trying to find a vulnerability in your system so that they could break in. I may be wrong but those IP's have been complained by other people:

http://ip-address-lookup-v4.com/ip/221.1.220.149
http://ip-address-lookup-v4.com/ip/58.218.199.250

I suggest you head over to our Malware Removal section and create a new thread there: http://forums.whatthetech.com/index.php?showforum=27
but before doing so please have a read here: http://forums.whatthetech.com/index.php?showtopic=106388 for the tools and logs that would be required of you.

Hi eBayvictim, Folks machines are more or less regularly being scanned for vulnerabilities on a big time basis…..Your firewall is there to help protect you against them and your logs indicate that it's doing its job…. ( if you had the Windows firewall then it would be doing the blocking of incoming stuff, that Sygate is doing but in the background so to speak with no notices to you, so you would probably not even be aware of it! (and would see no log files that sometimes can cause a fair bit of worry!) I no longer use Sygate as there are more modern alternatives available, as set out by 8210GUY However even the best firewall in the world, and the best Anti virus application in the world will not do the trick unless the 7 steps that I set out earlier are being used…. inzanity's' advice is, as always excellent, but in this particular case he may not be aware that you have just returned from the Virus and Spyware removal forum…. Hope this helps. Regards paws

Okey Dokey I'll have the read inzanity suggests, but I won't file another support case unless I have a real problem. Sygate is blocking all kinds of stuff, btw… I just didn't understand the scanning status….since it said someone "is" scanning your computer. But I see in another log that it's blocking all sorts of stuff. Maybe Sygate isn't going to be for me ultimately, but according to what I've read, it's owned and updated by the company who owns Norton. Thank you all for allaying my fears on this…. I'll check out all the links and threads you guys posted for me today.

PS: I would have read the instructions for using and interpreting this firewall, but I can't seem to find any, the help button takes you to the Norton home page.

Hi eBayvictim,
Yes the instructions can be a bit elusive!
However if you go here:
ftp://eps.unm.edu/pub/internet/spf42_userguide.pdf
you can download the complete set of instructions….( this is for V 4.2) but they should hold good for earlier/later versions)
So good luck and safe surfing!
Regards
paws

inzanity's' advice is, as always excellent, but in this particular case he may not be aware that you have just returned from the Virus and Spyware removal forum….

somehow Satchfan's name eludes me there. Thanks paws.

Hello Paws,

I'm wondering here….if I've messed something up

I read the sygate config stuff, and figured out how to block IPs from all incoming and outgoing access to all ports etc.

First I tried something I didn't fully understand…hope that didn't mess me up….the constant notifications of my computer being scanned from IPs in China, I tried clicking the "Action Tab" on the security log, and selected "stop all active response" to the Chinese IPs, to see what would happen, I figured if it was wrong, I could undo it…..not sure now what that means…does it mean I allowed them? or blocked them? and I can't find any way to see the status or undo what I did.

Then I did this (after I read the details of config again and better

I took the 3 or 4 chinese IPs from the log and set them in the advanced rules to be blocked.

It confirmed the new rules had been applied, and for a while there was no alerts at all….now I've just gotten two new logs saying that my computer is again being scanned from two of the identical IP addresses I currently have set to Block All … huh?

And another weird thing is happening….I am getting constant notifications that read:

"An application named NT Kernel & System (file name ntoskrnl.exe) has been blocked from accessing the network." This is happening continuously now, and the IP address it's coming from seems to be my cable company provider in Pa.

Everything works on the computer…I've not been blocked from doing anything (yet)

what's it look like is going on here?

this application for the kernel being denied every 2 minutes is driving me crazy.

Hi, eBayvictim,

I'm wondering here….if I've messed something up

I don't think you have messed things up but I think maybe you are triyng to set up rules to tell Sygate to do things that its doing already…..
My advice would be to consider long and hard before setting up rules….. the default settings suit most folks, unless you want to tunnel through the firewall for a specific reason…

Your firewall will "hide" your computer from the incoming port scans……. the incoming port scans that you are being notified about are ones that are happening most of the time to folks all over the world…its highly unlikely that you are being targeted as an individual…. Our firewalls give us protection from the scans…there is nothing that you need to do… just let Sygate get on with its job….
I feel that maybe you are being unnecessarily concerned about the scans from China…… those guys (and others) are scanning more or less continually across a wide spectrum of the Internet for unprotected computers….a good firewall will provide you with protection by hiding your computer from the scanners BUT it won't stop the scans from taking place….. Sygate is just notifying you of what its doing…..
There may be a setting in Sygate that you can find to"turn off notifications" if you can find it then consider using it….
If you really cant live with the constant notifications and cant find the setting to turn them off then you could consider uninstalling Sygate and switching on Windows firewall ( incoming protection only on Win XP)….. most folks these days are operating from behind a hardware firewall present in most routers. this provides additional protection…

I hope this helps put your mind at rest….
Regards
paws

well ok, … I figured that's what you might say…. I'll live with it for a while and see what happens. I don't have a router, mainly because I only have one computer and it's connected directly to the modem supplied by the cable company. Should I consider getting one? One thing is certain, I've got more protection now than I had with windows firewall…so there's that.

Now you know why I turn off such notifications lol, they will make you paranoid, and as a couple of us have said, there are many harmless reasons for these scans, there are obviously bad reasons as well, but these bad ones are in simple terms on a fishing trip, waiting to find someone who has left the door open, then they can get in, but a firewall stops these if working correctly, even the xp firewall would be doing a lot of what you are seeing now, the only difference is it would be doing it quietly, just because it doesn't shout from the tree tops doesn't mean it's not working, but that said the xp firewall is not as good as free alternate choices as laid out in this thread.

Something that may give you some assurance, and peace of mind is to run a few scans, these will try and do to you what these alerts are saying other things are doing, BUT, after it has finished each test it will tell you if they got through, if something did get through then thats the time to look closer and close the hole, but if all tests come back as Passes, which I suspect they will, then you have little to worry about, and hopefully you will be able to relax, but out of interest what do modem do you connect through ?

ShieldsUP!
Hackerwatch
Audit My PC

those will test your security from the net, with your permission of course, they all do similar things (from my understanding of such things), but some make more sense than others if your not sure what to expect, and finally should you feel something is running on your system that shouldn't be, maybe something doesn't feel quite right, then you can try out the following, hopefully you will breath easier after looking at all these.
What's running on your computer

the modem is just the scientific atlanta unit the cable company supplied btw….what do you think about this application for kernel denial that pops up now every 2 or 4 minutes? never happened before. a side note… I notice that chrome uses enormous numbers….in everything….I like the browser, but wow…what a resource hog