Reply
Regular Contributor
Wikipedian
Posts: 342
Registered: ‎09-29-2008
Accepted Solution

Intrusion Prevention

[ Edited ]

Can you please check and confirm is this normal.  I install NIS2010 at at about 3:20 P.M., turned off the computer, and turned it on at about 8 P.M.  However, there is only one instance of Intrusion Prevention starting in the Intrusion Prevention log.  Shouldn't it be listed twice?  Once at about 3:20 and once at about 8.  Please help!

 

ipprevent.PNG

Message Edited by Wikipedian on 10-08-2009 10:19 PM
We choose to go to the moon in this decade and do the other things, not because they are easy, but because they are hard --President John F. Kennedy
Rootkit Eradicator
Posts: 5,220
Registered: ‎05-30-2008

Re: Intrusion Prevention

Just looked at your Log and that is normal as they both provide differnet information.

 

Tuesday, May 21, 2013: The Symantec THREATCON was Changed to Level 1: Normal | Tuesday, May 14, 2013: Microsoft "Patch Tuesday" | Sunday, May 05, 2013: Microsoft Internet Explorer 8 Zero-Day Vulnerability (Update Released)
Regular Contributor
Wikipedian
Posts: 342
Registered: ‎09-29-2008

Re: Intrusion Prevention


Floating_Red wrote:

Just looked at your Log and that is normal as they both provide differnet information.

 


 

I mean about the instance of Intrusion prevention logged.  Shouldn't be 6 total instances?  In NIS09, every time I restart the computer there are three instances logged 1. showing tha IP is enable. 2. Showing the Engine version. and 3. The Intrusion Prevention definition.
We choose to go to the moon in this decade and do the other things, not because they are easy, but because they are hard --President John F. Kennedy
Rootkit Eradicator
Posts: 5,220
Registered: ‎05-30-2008

Re: Intrusion Prevention

[ Edited ]

Sorry, I don't quite understand what you're getting at; your Screen Shot only shows three, which is normal.  More will be Logged if the I.P.S. gets Updated.

 

_____________________________________________

 

 

Just understood what you mean; my apologies.  As long as your Intrusion Prevention is On and your Security Status is "Secure", then there's nothing to worry about.  And as long as it gets Logged in your Security History at least once-a-day, then there's nothing to worry.  However, if the Number of Signatures suddenly decreases, then I'd be worried if the Version Number hasn't changed.  I think there has to be a certain amount of time to pass before it is Logged again in the Security History.

 

You can always check which Version of I.P.S. you have installed by going to (Windows X.P.): Start > My Computer > C: > Documents and Settings > All Users > Application Data > Norton > {0C55C096-0F1D-4F28-AAA2-85EF591126E7} > NIS_17.x.x.x > Definitions > IPSDefs.

 

 

Message Edited by Floating_Red on 10-08-2009 10:50 PM
Message Edited by Floating_Red on 10-08-2009 10:58 PM
Message Edited by Floating_Red on 10-08-2009 11:00 PM
Tuesday, May 21, 2013: The Symantec THREATCON was Changed to Level 1: Normal | Tuesday, May 14, 2013: Microsoft "Patch Tuesday" | Sunday, May 05, 2013: Microsoft Internet Explorer 8 Zero-Day Vulnerability (Update Released)
SendOfJive
Posts: 9,908
Kudos: 4,195
Solutions: 706
Registered: ‎02-07-2009

Re: Intrusion Prevention

[ Edited ]

Hi Wikipedian,

 

Your log should show an entry for every time you have started your computer, going back quite a ways in time (days, weeks).  Try clicking the Refresh List button.  I note this is a new install, so you won't have a large history, but yes, if it is not logging  on each restart, something is not right.

Message Edited by SendOfJive on 10-08-2009 08:13 PM
Rootkit Eradicator
Posts: 5,220
Registered: ‎05-30-2008

Re: Intrusion Prevention

As SendOfJive pointed out, this may be a Logging Error, but that doesn''t mean you're not Protected, because you still are, which was my main concern.

 

 

Tuesday, May 21, 2013: The Symantec THREATCON was Changed to Level 1: Normal | Tuesday, May 14, 2013: Microsoft "Patch Tuesday" | Sunday, May 05, 2013: Microsoft Internet Explorer 8 Zero-Day Vulnerability (Update Released)
Regular Contributor
Wikipedian
Posts: 342
Registered: ‎09-29-2008

Re: Intrusion Prevention


SendOfJive wrote:

Hi Wikipedian,

 

Your log should show an entry for every time you have started your computer, going back quite a ways in time (days, weeks).  Try clicking the Refresh List button.  I note this is a new install, so you won't have a large history, but yes, if it is not logging  on each restart, something is not right.

Message Edited by SendOfJive on 10-08-2009 08:13 PM

 

How to fix this "logging error"?  It's a new installation and I'm already having problems!
We choose to go to the moon in this decade and do the other things, not because they are easy, but because they are hard --President John F. Kennedy
Regular Contributor
Wikipedian
Posts: 342
Registered: ‎09-29-2008

Re: Intrusion Prevention


Floating_Red wrote:

Sorry, I don't quite understand what you're getting at; your Screen Shot only shows three, which is normal.  More will be Logged if the I.P.S. gets Updated.

 

_____________________________________________

 

 

Just understood what you mean; my apologies.  As long as your Intrusion Prevention is On and your Security Status is "Secure", then there's nothing to worry about.  And as long as it gets Logged in your Security History at least once-a-day, then there's nothing to worry.  However, if the Number of Signatures suddenly decreases, then I'd be worried if the Version Number hasn't changed.  I think there has to be a certain amount of time to pass before it is Logged again in the Security History.

 

You can always check which Version of I.P.S. you have installed by going to (Windows X.P.): Start > My Computer > C: > Documents and Settings > All Users > Application Data > Norton > {0C55C096-0F1D-4F28-AAA2-85EF591126E7} > NIS_17.x.x.x > Definitions > IPSDefs.

 

 

Message Edited by Floating_Red on 10-08-2009 10:50 PM
Message Edited by Floating_Red on 10-08-2009 10:58 PM
Message Edited by Floating_Red on 10-08-2009 11:00 PM

 

THe IPS def is saying 20090911.001.  However, I noted on the Norton website that this is not the latest defs.  When will I get the latest defs?
We choose to go to the moon in this decade and do the other things, not because they are easy, but because they are hard --President John F. Kennedy
Rootkit Eradicator
Posts: 5,220
Registered: ‎05-30-2008

Re: Intrusion Prevention

Hi,

 

The one your seeing is for Norton 2009 Products; Norton 2010 Products may differ because it uses New Engines which better-protect you.  If there are Updates due for your Norton-branded Product, am sure they'll be Released as soon as possible.

 

Tuesday, May 21, 2013: The Symantec THREATCON was Changed to Level 1: Normal | Tuesday, May 14, 2013: Microsoft "Patch Tuesday" | Sunday, May 05, 2013: Microsoft Internet Explorer 8 Zero-Day Vulnerability (Update Released)
Axios
Posts: 300
Topics: 80
Kudos: 15
Ideas: 0
Solutions: 21
Registered: ‎09-13-2008

Re: Intrusion Prevention