Detecting intrusion attempts

Detecting intrusion attempts copyright 2004 Symantec

Intrusion Detection checks for suspected attacks against your computer and can block communication from the computers that are initiating the attacks.

More Information


About Intrusion Detection

About Intrusion Detection copyright 2004 Symantec

Intrusion Detection scans all the network traffic that enters and exits your computer and compares this information against a set of attack signatures, arrangements of information that identify an attacker's attempt to exploit a known operating system or program vulnerability.

If the information matches an attack signature, Intrusion Detection automatically discards the packet and severs the connection with the computer that sent the data. This protects your computer from being affected in any way.

Intrusion Detection protects your computer against most common Internet attacks, including the following.

BEAGLE_A_B_BACKDOOR_ANNOUNCE | A backdoor included with the W32.Beagle.A@mm worm. This backdoor will announce its presence to the owner of the worm, allowing the attacker to issue commands, download files, and execute other malicious actions.
WINDOWS_LOCATORSVC_OVERFLOW | A method of exploiting the Microsoft Windows RPC (Remote Procedure Call) Locator service to execute malicious commands or crash the computer.
MS_MESSENGER_BO | An attack on the Microsoft Messenger Service that can result in a denial of service or execution of malicious code.
Bonk | An attack on the Microsoft TCP/IP stack that can crash the attacked computer.
RDS_Shell | A method of exploiting the Remote Data Services component of the Microsoft Data Access Components that lets a remote attacker run commands with system privileges.
WinNuke | An exploit that can use NetBIOS to crash older Windows computers.

More Info about the attacks that Intrusion Detection blocks

Intrusion Detection does not scan for intrusions by computers in your Trusted Zone. However, Intrusion Detection does monitor the information that you send to Trusted computers for signs of zombies and other remote control attacks.

Intrusion Detection relies on an extensive list of attack signatures to detect and block suspicious network activity. Run LiveUpdate regularly to ensure that your list of attack signatures is up to date.

More Information


Customize Intrusion Detection

Customize Intrusion Detection copyright 2004 Symantec

The default Intrusion Detection settings should provide adequate protection for most users. You can customize Intrusion Detection by excluding specific network activity from monitoring, enabling or disabling AutoBlock, and restricting blocked computers.

More Information

Exclude specific network activity from being monitored
Turn on or turn off Intrusion Detection alerts
Turn on or turn off AutoBlock
Unblock AutoBlocked computers
Exclude computers from AutoBlock
Restrict a blocked computer


Turn on or turn off Intrusion Detection alerts

Turn on or turn off Intrusion Detection alerts copyright 2004 Symantec

You can choose whether you want to receive alerts when Intrusion Detection blocks suspected attacks. The alerts include more information about the attacking computer and information about the attack.

To turn on or turn off Intrusion Detection alerts

  1. In the main window, double-click Intrusion Detection.
  2. In the Intrusion Detection window, on the Intrusion Detection tab, check or uncheck Notify me when Intrusion Detection blocks connections.
  3. Click OK.

Turn on or turn off an individual Intrusion Detection alert

You can also choose whether you want to receive alerts when Intrusion Detection blocks suspected attacks based on a particular signature.

To turn on or turn off an individual Intrusion Detection alert

  1. In the main window, double-click Intrusion Detection.
  2. In the Intrusion Detection window, on the Intrusion Detection tab, click Advanced.
  3. In the Signature Exclusions window, click an attack signature, and then click Properties.
  4. In the Signature Properties dialog box, check or uncheck Alert me when this signature is detected, and then click OK.
  5. In the Signature Exclusions window, click OK.
  6. In the Intrusion Detection window, click OK.

More Information

Customize Intrusion Detection
Exclude specific network activity from being monitored
Turn on or turn off AutoBlock
Unblock AutoBlocked computers
Exclude computers from AutoBlock
Restrict a blocked computer
Respond to security protection alerts
Learn more with the Alert Assistant


Exclude specific network activity from being monitored

Exclude specific network activity from being monitored copyright 2004 Symantec

In some cases, benign network activity may appear similar to an attack signature. If you receive repeated warnings about possible attacks, and you know that these warnings are being triggered by safe behavior, you can create an exclusion for the attack signature that matches the benign activity.

Each exclusion that you create leaves your computer vulnerable to attacks. Be very selective when excluding attacks. Only exclude behavior that is always benign.

To exclude attack signatures from being monitored

  1. In the main window, double-click Intrusion Detection.
  2. In the Intrusion Detection window, on the Intrusion Detection tab, click Advanced.
  3. In the Signature Exclusions window, uncheck the attack signatures that you want to exclude.
  4. Click OK.
  5. In the Intrusion Detection window, click OK.

If you have excluded attack signatures that you want to monitor again, you can include them in the list of active signatures.

To include attack signatures

  1. In the main window, double-click Intrusion Detection.
  2. In the Intrusion Detection window, on the Intrusion Detection tab, click Advanced.
  3. In the Signature Exclusions window, check the attack signatures that you want to monitor.
  4. Click OK.
  5. In the Intrusion Detection window, click OK.

More Information

Customize Intrusion Detection
Turn on or turn off AutoBlock
Unblock AutoBlocked computers
Turn on or turn off Intrusion Detection alerts
Exclude computers from AutoBlock
Restrict a blocked computer


Turn on or turn off AutoBlock

Turn on or turn off AutoBlock copyright 2004 Symantec

When an attack is detected, the connection is automatically blocked to ensure that your computer is safe. The program can also activate AutoBlock, which automatically blocks all incoming communication from the attacking computer for a set period of time, even if the incoming communication does not match an attack signature.

If AutoBlock is blocking a computer or computers you need to access, you can turn off AutoBlock. Make sure to turn on AutoBlock when you are done.

To turn on AutoBlock

  1. In the main window, double-click Intrusion Detection.
  2. In the Intrusion Detection window, on the AutoBlock tab, check Turn on AutoBlock.
  3. In the AutoBlock attacking computer for drop-down menu, choose how long you want to block attacking computers. By default, AutoBlock blocks each computer for 30 minutes.
  4. Click OK.

AutoBlock stops all inbound communications with a specific computer. To stop all inbound and outbound communication with all computers, use Block Traffic.

To turn off AutoBlock

  1. In the main window, double-click Intrusion Detection.
  2. In the Intrusion Detection window, on the AutoBlock tab, uncheck Turn on AutoBlock.
  3. Click OK.

More Information

Customize Intrusion Detection
Exclude specific network activity from being monitored
Unblock AutoBlocked computers
Exclude computers from AutoBlock
Restrict a blocked computer
 Stop all Internet communication


Unblock AutoBlocked computers

Unblock AutoBlocked computers copyright 2004 Symantec

In some cases, AutoBlock may recognize normal activity as an attack. If you can't communicate with computers that you should be able to communicate with, they may be on the list of computers currently blocked by AutoBlock.

If a computer that you need to access appears on the list of computers currently blocked by AutoBlock, unblock it. If you have changed your protection settings and want to reset your AutoBlock list, you can unblock all of the computers on the AutoBlock list at once.

To unblock computers currently blocked by AutoBlock

  1. In the main window, double-click Intrusion Detection.
  2. In the Intrusion Detection window, on the AutoBlock tab, do one of the following:
    • To unblock one computer, select its IP address, and then click Unblock.
    • To unblock all computers on the AutoBlock list, click Unblock All.
  3. Click OK.

More Information

Customize Intrusion Detection
Turn on or turn off AutoBlock
Exclude specific network activity from being monitored
Exclude computers from AutoBlock
Restrict a blocked computer


Exclude computers from AutoBlock

Exclude computers from AutoBlock copyright 2004 Symantec

If a computer you need to access is repeatedly placed in the AutoBlock list, you can exclude it from being blocked by AutoBlock.

To exclude specific computers from AutoBlock

  1. In the main window, double-click Intrusion Detection.
  2. In the Intrusion Detection window, on the AutoBlock tab, click Exclusions.
  3. Do one of the following:
    • In the Currently blocked list, select a blocked IP address, and then click Exclude.
    • Click Add, and then type the computer's name, IP address, network identification, or a range of IP addresses containing the computer that you want to exclude, and then click OK.
  4. When you are done excluding IP addresses, click OK.
  5. In the AutoBlock tab, click OK.

More Information

Customize Intrusion Detection
Turn on or turn off AutoBlock
Unblock AutoBlocked computers
Exclude specific network activity from being monitored
Restrict a blocked computer


Restrict a blocked computer

Restrict a blocked computer copyright 2004 Symantec

You can add a blocked computer to your Restricted Zone to permanently prevent that computer from accessing your computer. Computers in the Restricted Zone do not appear on the blocked list because all communication with restricted computers is blocked.

To restrict a blocked computer

  1. In the main window, double-click Intrusion Detection.
  2. In the Intrusion Detection window, on the AutoBlock tab, in the list of computers that are currently blocked by AutoBlock, select the computer to add to the Restricted Zone.
  3. Click Restrict.
  4. When you are done restricting computers, click OK.

More Information

Customize Intrusion Detection
Turn on or turn off AutoBlock
Unblock AutoBlocked computers
Exclude computers from AutoBlock
Exclude specific network activity from being monitored


Warning

Warning copyright 2004 Symantec

When Intrusion Detection is turned off, your computer is not protected from Internet threats. If you cannot view certain online content, you should adjust individual security settings instead of turning off Intrusion Detection.

If you must turn off Intrusion Detection, you should turn it off temporarily to ensure that it will turn on again automatically.

To temporarily turn off Intrusion Detection

  • In the drop-down list, select how long you want to turn off Intrusion Detection, and then click OK.

To ensure that your computer remains protected, you can turn on Intrusion Detection manually before the time that you specified concludes.


Signature properties

Signature properties copyright 2004 Symantec

You can also choose whether you want to receive alerts when Intrusion Detection blocks suspected attacks based on a particular signature. The alerts include more information about the attacking computer and the attack.

To turn on or turn off an individual Intrusion Detection alert

  • In the Signature Properties dialog box, check or uncheck Alert me when this signature is detected, and then click OK.