Guarding against blended threats

Guarding against blended threats copyright 2004 Symantec
If you own Norton Internet Security, its Personal Firewall is used to guard against blended threats.

Internet Worm Protection prevents certain network worms and other Internet threats from attacking your computer by employing basic inbound port blocking (which utilizes known worm signatures) and network monitoring methods.

More Information


About Norton Internet Worm Protection

About Norton Internet Worm Protection copyright 2004 Symantec

Internet Worm Protection's default settings for basic inbound port blocking and network monitoring provide network protection against worms and other malicious activity. However, if you are an experienced Internet user, you can create and modify your own rules and settings.

You can customize the following types of rules:

Exclusions | Exclude and include worm signatures from detection. | Customize signature detection
Program Rules | Control a program's access to the Internet. | Customize Program rules
Customize General Rules | Use rules to monitor network traffic for worms, malicious incoming traffic, programs, and Trojan horses. | Customize General Rules
Trojan Rules | Detect varieties of Trojan horses. | Customize a Trojan Horse Rule
AutoBlock Rules | Block malicious attacks. | Customize AutoBlock

More Information


How rules are processed

How rules are processed copyright 2004 Symantec

General Rules are processed in a set order based on their types. General Rules are processed first, followed by Program Rules, and then Trojan horse Rules.

Once a rule that blocks or permits communications is matched, all remaining rules are ignored. In other words, additional rules that match this type of communication are ignored if they appear below the first rule that matches.

For example, you may have a rule that blocks the use of Symantec pcAnywhere on your computer. If you add a rule that permits the use of Symantec pcAnywhere with a specific computer and move the new rule higher in the list, the new rule lets you use Symantec pcAnywhere with that specific computer, but the earlier rule prevents its use with any other computer.

If no matching rule is found, the communication is blocked.

Communications must match all of a rule's criteria. For example, a rule that blocks communication to and from port 41 will not match a connection attempt from port 80 to port 41. Two rules would be required to block all traffic using that port number: one for incoming and one for outgoing traffic.


If Internet Worm Protection detects a blended threat

If Internet Worm Protection detects a blended threat copyright 2004 Symantec

Internet Worm Protection issues different types of alerts depending on the type of activity it detects on the network. In addition, it detects activity and creates rules based on that activity without requiring your intervention.

More Information


Automatic handling of detected threats

Automatic handling of detected threats copyright 2004 Symantec

Internet Worm Protection detects threats and network events which it can automatically handle without your intervention. Automatic handling of an event occurs in the following scenarios:

  • When Internet Worm Protection detects and recognizes a program opening a port for listening, it automatically creates a Program Rule that matches the event.
  • When Internet Worm Protection detects and recognizes incoming traffic to an open port, it creates a Program Rule to match this event.
  • When Internet Worm Protection detects, but does not recognize a program that opens a port for listening. After it performs a virus scan and finds the program free of infection, and locates a Symantec digital signature, a Permit Rule is created for the program.
  • When Internet Worm Protection detects, but does not recognize incoming traffic to a port, opened by a program. After it performs a virus scan and finds the program free of infection, and locates a Symantec digital signature, a Permit Rule is created for the program.
  • When Internet Worm Protection detects either a program opening a port for listening, or when it detects incoming traffic to a port (opened by a program), Internet Worm Protection performs a virus scan. After the scan reports an infection, which triggers a virus scan from the main window in Norton AntiVirus, Internet Worm Protection blocks the program, but does so only once; it does not generate a Block Rule, because Norton AntiVirus may have repaired the program.


Internet Worm Protection Alerts

Internet Worm Protection Alerts copyright 2004 Symantec

Internet Worm Protection detects programs, such as Web servers and multiplayer games, that open ports to listen for connections from other computers. If an automatic scan of the program does not detect a virus, and if a Symantec digital signature is located, and if a rule does not exist to control the program's access to the Internet, Internet Worm Protection issues an alert, which provides information about the traffic.

The alert requires you to make a decision about the event. Your options are:

Permit | Permit this program to access the Internet. If you recognize the program and trust it to be safe, select this option. Internet Worm Protection creates a Permit Rule for this program.
Block | Block this program from accessing the Internet. Select this option if you do not recognize the program and the risk is high. Internet Worm Protection creates a Block Rule for this program.

Internet Worm Protection also generates an alert in the following situations:

  • Internet worm protected detects inbound network traffic to a port that a program has opened for listening. Internet Worm Protection scans the program and reports no infection, nor a Symantec digital signature.
  • A program attempts to open a port that is commonly used by Trojan horse programs.
  • Internet Worm Protection detects that network traffic is malicious.


Customize signature detection

Customize signature detection copyright 2004 Symantec

In some cases, benign network activity may appear similar to an attack signature. A signature is a unique string of bits, or the binary pattern, of a worm. Like a fingerprint, it can be used to detect and identify specific worms. If you receive repeated warnings about possible attacks, and you know that these warnings are being triggered by safe behavior, you can create an exclusion for the attack signature that matches the benign activity. Be sure to use LiveUpdate to obtain and automatically install the latest worm signatures for Internet Worm Protection.

Each exclusion that you create leaves your computer vulnerable to attacks. Be very selective when excluding attacks. Only exclude behavior that is always benign.

To exclude a worm signature

  1. In the Internet Worm Protection window, click Configure Exclusions.
  2. In the Signature Exclusions dialog box, check the signature in the Signatures list that you want to exclude.
  3. Click OK to close the window.

To include a worm signature

  1. In the Internet Worm Protection window, click Configure Exclusions.
  2. In the Signature Exclusions dialog box, in the Excluded Signatures list, check the signature that you want to include.
  3. Click Include.
  4. Click OK to close the window.

LiveUpdate obtains and automatically installs the latest worm signatures for Internet Worm Protection.


Customize Program rules

Customize Program rules copyright 2004 Symantec

You can quickly customize settings that block or permit inbound access to programs on your computer.

This feature is very useful in preventing spyware attacks. For example, a program that contains a Trojan horse can provide a backdoor entry to the computer and send important data about your computer out to the Internet. Creating a Program Rule that blocks inbound access to your programs can prevent such activity.

More Information


Create Program rules

Create Program rules copyright 2004 Symantec

Create a Program Rule to strictly control inbound access to a program on your computer.

To create a Program Rule

  1. In the Internet Worm Protection window, click Program Control.
  2. In the Program Control dialog box, click Add.
  3. Select the program's executable file.
  4. Click Open.
  5. In the Program Control alert, assign an access level to your program. Your options are:

    Automatically configure Internet access (Recommended)

    Automatically configure Internet access. This is usually the best option.

    Permit

    Permit inbound access to this program. This is not as safe as choosing Automatic, but it is appropriate for many programs that are not recognized. If you recognize the program and trust it to be safe, select this option.

    Block

    Block any inbound access to the selected program. Select this option if you do not recognize the program and the risk is high.

    Manually configure Internet access

    Customize inbound access for this program. Select this option if you understand how the program accesses the Internet.

  6. Click OK.


Change Program rules

Change Program rules copyright 2004 Symantec

After using Norton AntiVirus for a while, you may find that you need to change access settings for certain programs. The steps necessary to change a Program Rule are similar to those required to create a Program Rule.

To change a Program Rule

  1. In the Internet Worm Protection window, click Program Control.
  2. In the Program list, select the program.
  3. Click Modify.
  4. In the Program Control alert, assign an access level to your program. Your options are:

    Automatically configure Internet access (Recommended)

    Allow Norton Internet Worm Protection to configure Internet access for the program without your intervention.

    Permit

    Allow all access attempts to this program.

    Block

    Deny all access attempts to this program.

    Manually configure Internet access

    Create a rule that controls how this program is accessed.

  5. Click OK.


Remove Program rules

Remove Program rules copyright 2004 Symantec

If you find that you no longer require a Program Rule, perhaps because you have uninstalled a corresponding program or that a rule is unnecessary, you can easily remove the rule.

To remove a Program Rule

  1. In the Internet Worm Protection window, click Program Control.
  2. Select a program from the Program list.
  3. Click Remove.


Customize General Rules

Customize General Rules copyright 2004 Symantec

General Rules in Internet Worm Protection monitor communications between your computer and other computers on the Internet. The default rules should provide adequate protection for most users. If the default protection is not appropriate, then you can create and customize your own rules.

More Information


About General Rules

About General Rules copyright 2004 Symantec

General Rules control how Internet Worm Protection protects your computer from worms, malicious incoming traffic, programs, and Trojan horses. Internet Worm Protection automatically checks all data coming in or out of your computer against these rules.

General Rules are predefined and enabled in Internet Worm Protection. These rules provide basic network functionality as well as protect you from known Internet risks. The default settings for General Rules include the following:

Default Non-Routable IPs | Blocks all incoming traffic from non-routable IPs.
Default Inbound ICMP | Permits safe types of inbound ICMP messaging. ICMP messages provide status and control information.
Default Block Inbound ICMP | Blocks all other inbound ICMP messaging, not listed in the Default Inbound ICMP rule.
Default Inbound DNS | Permits the use of the Domain Name System (DNS).
Default Inbound NetBIOS Name | Controls the use of the NetBIOS name service, which is used in file sharing on the Microsoft Network.
Default Inbound NetBIOS | Controls the use of the NetBIOS datagram service, which is used in file sharing on the Microsoft Network.
Block Windows File Sharing | Blocks Windows file sharing, a protocol to exchange files on a Windows Network.
Default Inbound Bootp | Permits the use of the BOOTP service. Bootstrap Protocol enables a computer to discover its own IP address.
Default Block Microsoft Windows 2000 SMB | Blocks Microsoft Windows Server Message Block, which is a message format used by DOS and Windows to share files, directories and devices.
UPNP Port 5000 Block Rule | Blocks Universal Plug and Play port 5000. Universal Plug and Play is a networking architecture that provides compatibility among networking equipment, software and peripherals. UPnP is device-driver independent and requires no network configuration.
UPNP Port 1900 Block Rule | Blocks Universal Plug and Play port 1900.

More Information


Create a General Rule

Create a General Rule copyright 2004 Symantec

Internet Worm Protection lets you define your own General Rules, and guides you through the steps.

To write a General Rule

  1. In the Internet Worm Protection window, click General Rules.
  2. In the General Rules dialog box, click Add.
  3. Select the action for this rule. Your options are:

    Permit

    Allow communication of this type to take place.

    Block

    Prevent communication of this type from taking place.

  4. Click Next.
  5. Select the type of connection that your rule should monitor. Your options are:

    Connections from other computers

    Applies to inbound connections from another computer to your computer.

  6. Click Next.
  7. Select the computers your rule should monitor. Your options are:

    Any computer

    Applies to all computers.

    Only the computers and sites listed below

    Applies only to the computers, sites, and domains listed.

  8. If you select Only the computers and sites listed below, click Add.
  9. In the Networking dialog box your options are:

    Individually

    Specify the computer, either by name or by Internet address.

    Using a range

    A starting and ending Internet address.

    Using a network address

    A network address and the subnet mask.

  10. Click OK.
  11. Click Next.
  12. Select the protocols that your rule should monitor. Your options are:

    TCP

    Applies to TCP (Transmission Control Protocol) communications.

    UDP

    Applies to UDP (User Datagram Protocol) communications.

    TCP and UDP

    Applies to both TCP and UDP communications.

    ICMP

    Applies to ICMP (Internet Control Message Protocol) communications. This option is available only when adding or modifying a General Rule.

  13. Select the ports that your rule should monitor. Your options are:

    All types of communications (all ports)

    Applies to communications using any port.

    Only the types of communications or ports listed below

    Applies to the ports listed. You can add ports to, or remove ports from, the list.

  14. If you selected Only the types of communications or ports listed below, click Add.
  15. If you selected either the TCP, UDP, or TCP and UDP protocols, enter ports in the Specify Ports dialog box. Your options are:

    Filter by

    Specifies the methods of communication, or ports, to which this rule applies.

    Known ports from list

    Applies to the selected ports in the list. Check each port to which you want this rule to apply.

    Individually specified ports

    Applies to a command number or numbers that you enter.

    Port range

    Applies to a series of ports. Enter the starting (lowest) port number and the ending (highest) port number.

    Locality

    Applies to local and remote ports. Local ports are those on your computer that are usually used for inbound connections. Remote ports are on the computer with which your computer is communicating. They are usually used for outbound connections.

  16. If on the previous window, you selected the ICMP protocol, you can specify special categories of commands for ICMP communication. The categories are:

    Known commands from a list

    Applies to the selected commands in the list. Check each command to which you want this rule to apply.

    Individually specified commands

    Applies to the commands that you enter. You can enter multiple port numbers separated by spaces.

    Command range

    Applies to a series of commands. Enter the starting command and the ending command.

  17. Click OK.
  18. Click Next.
  19. Select if and how you want your rule to be tracked. Your options are:

    Only log event after it occurs X times

    Control when Internet Worm Protection begins logging network communication that matches this rule.

    Create an Event Log entry

    An entry is created in the Internet Worm Protection Event Log when a network communication event matches this rule.

    Guarding against blended threats

  20. Click Next.
  21. In the What do you want to call this rule? text box, type a name for this rule.
  22. Click Next.
  23. Review the new rule settings to ensure they are correct, and then click Finish.
  24. When you have finished adding rules, click OK.


Change a General Rule

Change a General Rule copyright 2004 Symantec

You can change General Rules if they are not functioning in the way that you want.

To change an existing General Rule

  1. In the General Rules window, select the rule that you want to change.
  2. Click Modify.
  3. Follow the on-screen instructions to change any aspect of the rule.
  4. When you have finished changing the rule, click OK.

Each list of General Rules is processed from the top down. You can change the way in which rules are processed by changing their order.

To change the order of General Rules

  1. In the General Rules window, select the rule that you want to move.
  2. Do one of the following:
    • To process this rule before the rule above it, click Move Up.
    • To process this rule after the rule below it, click Move Down.
  3. When you have finished moving the rules, click OK.


Remove a General Rule

Remove a General Rule copyright 2004 Symantec

You can remove General Rules when they are no longer necessary.

To remove a General Rule

  1. In the General Rules window, select the rule that you want to remove.
  2. Click Remove.
  3. When you have finished removing rules, click OK.


Customize a Trojan Horse Rule

Customize a Trojan Horse Rule copyright 2004 Symantec

By default, Internet Worm Protection employs numerous Trojan Horse Rules to protect your computer. If it detects a Trojan Horse that matches a rule, Internet Worm Protection issues an alert. These rules are supplied by Symantec and kept current by LiveUpdate.

Remove Trojan Horse Rules when they are no longer necessary or when you believe that Norton AntiVirus is misidentifying the signature as a Trojan horse. You should not change these rules without knowing how your changes will impact your protection.

To remove a Trojan Horse Rule

  1. In the Internet Worm Protection window, click Trojan Rules.
  2. In the Trojan Horse Rules dialog box, click the rule's check box.
  3. Click OK.


Customize AutoBlock

Customize AutoBlock copyright 2004 Symantec

If AutoBlock is on and Internet Worm Protection determines that a recent incoming communication attempt may have been part of an attack, it automatically blocks all communication with this computer for 30 minutes.

Occasionally, normal activity might be interpreted as an attack. If you are unable to communicate with a specific computer, see if it is on the list of computers currently blocked by AutoBlock. Internet Worm Protection lets you manually unblock the computer's IP address at any time.

To prevent a computer attack from the Internet, turn on AutoBlock.

To turn on AutoBlock

  1. In the Internet Worm Protection window, click AutoBlock Rules.
  2. In the AutoBlock dialog box, check Turn on AutoBlock (recommended).

Remove computers from the AutoBlock list when they no longer pose a threat.

To remove computers from the AutoBlock list

  1. In the AutoBlock dialog box, select a computer.
  2. Click Unblock.

To remove all computers from the AutoBlock list

  1. In the AutoBlock dialog box, select a computer.
  2. Click Unblock All.