• All Community
    • All Community
    • Forums
    • Ideas
    • Blogs
Advanced

Not what you are looking for? Ask the experts!

This forum thread needs a solution.
Kudos0

Intrusion Prevention

Can you please check and confirm is this normal.  I install NIS2010 at at about 3:20 P.M., turned off the computer, and turned it on at about 8 P.M.  However, there is only one instance of Intrusion Prevention starting in the Intrusion Prevention log.  Shouldn't it be listed twice?  Once at about 3:20 and once at about 8.  Please help!

Message Edited by Wikipedian on 10-08-2009 10:19 PM
File Attachment: 
“ We choose to go to the moon in this decade and do the other things, not because they are easy, but because they are hard ”--President John F. Kennedy

Replies

Kudos0

Re: Intrusion Prevention

Can you please check and confirm is this normal.  I install NIS2010 at at about 3:20 P.M., turned off the computer, and turned it on at about 8 P.M.  However, there is only one instance of Intrusion Prevention starting in the Intrusion Prevention log.  Shouldn't it be listed twice?  Once at about 3:20 and once at about 8.  Please help!

Message Edited by Wikipedian on 10-08-2009 10:19 PM
“ We choose to go to the moon in this decade and do the other things, not because they are easy, but because they are hard ”--President John F. Kennedy
Kudos0

Re: Intrusion Prevention

Just looked at your Log and that is normal as they both provide differnet information.

Thursday, November 21, 2013: The THREATCON was changed to Level 1: Normal | Tue., Nov. 05, 2013: Zero-Day Vulnerability: Microsoft Security Advisory 2896666 | Saturday, November 09, 2013: Cyber-Criminals Serve Up A Veritable Smorgasbord Of Threats For South Koreans | Wednesday, October 09, 2013: New Internet Explorer Zero-Day Targeted In Attacks Against Korea And Japan [C.V.E.-2013-3897]
Kudos0

Re: Intrusion Prevention


Floating_Red wrote:

Just looked at your Log and that is normal as they both provide differnet information.


I mean about the instance of Intrusion prevention logged.  Shouldn't be 6 total instances?  In NIS09, every time I restart the computer there are three instances logged 1. showing tha IP is enable. 2. Showing the Engine version. and 3. The Intrusion Prevention definition.
“ We choose to go to the moon in this decade and do the other things, not because they are easy, but because they are hard ”--President John F. Kennedy
Kudos0

Re: Intrusion Prevention

Sorry, I don't quite understand what you're getting at; your Screen Shot only shows three, which is normal.  More will be Logged if the I.P.S. gets Updated.

_____________________________________________

Just understood what you mean; my apologies.  As long as your Intrusion Prevention is On and your Security Status is "Secure", then there's nothing to worry about.  And as long as it gets Logged in your Security History at least once-a-day, then there's nothing to worry.  However, if the Number of Signatures suddenly decreases, then I'd be worried if the Version Number hasn't changed.  I think there has to be a certain amount of time to pass before it is Logged again in the Security History.

You can always check which Version of I.P.S. you have installed by going to (Windows X.P.): Start > My Computer > C: > Documents and Settings > All Users > Application Data > Norton > {0C55C096-0F1D-4F28-AAA2-85EF591126E7} > NIS_17.x.x.x > Definitions > IPSDefs.

Message Edited by Floating_Red on 10-08-2009 10:50 PMMessage Edited by Floating_Red on 10-08-2009 10:58 PMMessage Edited by Floating_Red on 10-08-2009 11:00 PM
Thursday, November 21, 2013: The THREATCON was changed to Level 1: Normal | Tue., Nov. 05, 2013: Zero-Day Vulnerability: Microsoft Security Advisory 2896666 | Saturday, November 09, 2013: Cyber-Criminals Serve Up A Veritable Smorgasbord Of Threats For South Koreans | Wednesday, October 09, 2013: New Internet Explorer Zero-Day Targeted In Attacks Against Korea And Japan [C.V.E.-2013-3897]
Kudos0

Re: Intrusion Prevention

Hi Wikipedian,

Your log should show an entry for every time you have started your computer, going back quite a ways in time (days, weeks).  Try clicking the Refresh List button.  I note this is a new install, so you won't have a large history, but yes, if it is not logging  on each restart, something is not right.

Message Edited by SendOfJive on 10-08-2009 08:13 PM
Kudos0

Re: Intrusion Prevention

As SendOfJive pointed out, this may be a Logging Error, but that doesn''t mean you're not Protected, because you still are, which was my main concern.

Thursday, November 21, 2013: The THREATCON was changed to Level 1: Normal | Tue., Nov. 05, 2013: Zero-Day Vulnerability: Microsoft Security Advisory 2896666 | Saturday, November 09, 2013: Cyber-Criminals Serve Up A Veritable Smorgasbord Of Threats For South Koreans | Wednesday, October 09, 2013: New Internet Explorer Zero-Day Targeted In Attacks Against Korea And Japan [C.V.E.-2013-3897]
Kudos0

Re: Intrusion Prevention


SendOfJive wrote:

Hi Wikipedian,

Your log should show an entry for every time you have started your computer, going back quite a ways in time (days, weeks).  Try clicking the Refresh List button.  I note this is a new install, so you won't have a large history, but yes, if it is not logging  on each restart, something is not right.

Message Edited by SendOfJive on 10-08-2009 08:13 PM
How to fix this "logging error"?  It's a new installation and I'm already having problems!
“ We choose to go to the moon in this decade and do the other things, not because they are easy, but because they are hard ”--President John F. Kennedy
Kudos0

Re: Intrusion Prevention


Floating_Red wrote:

Sorry, I don't quite understand what you're getting at; your Screen Shot only shows three, which is normal.  More will be Logged if the I.P.S. gets Updated.

_____________________________________________

Just understood what you mean; my apologies.  As long as your Intrusion Prevention is On and your Security Status is "Secure", then there's nothing to worry about.  And as long as it gets Logged in your Security History at least once-a-day, then there's nothing to worry.  However, if the Number of Signatures suddenly decreases, then I'd be worried if the Version Number hasn't changed.  I think there has to be a certain amount of time to pass before it is Logged again in the Security History.

You can always check which Version of I.P.S. you have installed by going to (Windows X.P.): Start > My Computer > C: > Documents and Settings > All Users > Application Data > Norton > {0C55C096-0F1D-4F28-AAA2-85EF591126E7} > NIS_17.x.x.x > Definitions > IPSDefs.

Message Edited by Floating_Red on 10-08-2009 10:50 PMMessage Edited by Floating_Red on 10-08-2009 10:58 PMMessage Edited by Floating_Red on 10-08-2009 11:00 PM
THe IPS def is saying 20090911.001.  However, I noted on the Norton website that this is not the latest defs.  When will I get the latest defs?
“ We choose to go to the moon in this decade and do the other things, not because they are easy, but because they are hard ”--President John F. Kennedy
Kudos0

Re: Intrusion Prevention

Hi,

The one your seeing is for Norton 2009 Products; Norton 2010 Products may differ because it uses New Engines which better-protect you.  If there are Updates due for your Norton-branded Product, am sure they'll be Released as soon as possible.

Thursday, November 21, 2013: The THREATCON was changed to Level 1: Normal | Tue., Nov. 05, 2013: Zero-Day Vulnerability: Microsoft Security Advisory 2896666 | Saturday, November 09, 2013: Cyber-Criminals Serve Up A Veritable Smorgasbord Of Threats For South Koreans | Wednesday, October 09, 2013: New Internet Explorer Zero-Day Targeted In Attacks Against Korea And Japan [C.V.E.-2013-3897]
Kudos0

Re: Intrusion Prevention

This thread is closed from further comment. Please visit the forum to start a new thread.