Norton PF 2002 configuring over and over...

Discussion in 'Computer Security' started by Chuk Goodin, May 17, 2004.

  1. Chuk Goodin

    Chuk Goodin Guest

    Lately whenever I go on the internet, I notice a huge slowdown on my PC.
    So we checked the running processes and some other status things, and it
    turns out that our Norton Personal Firewall 2002 is getting a "Firewall
    configuration updated" message 2-4 times per second! It used to only do
    that once a day. Our Win98 machine is doing it too (the main PC is XP Pro
    and we're sharing a DSL connection).

    LiveUpdate still works, we don't have any viruses (the Symantec automatic
    support said that we had MyDoom, but the removal tool didn't find it), and
    things like ICQ and PuTTy still seem to work fine. If we don't have an IE
    window open, everything is slow.

    Has anyone heard of this before? Is it just Norton's way of forcing an
    upgrade? Our subscription is still valid.

    --
    chuk
    Chuk Goodin, May 17, 2004
    #1
    1. Advertising

  2. Chuk Goodin

    Guest

    On Mon, 17 May 2004 17:29:24 +0000 (UTC), (Chuk Goodin)
    brought the following to our attention:

    >Lately whenever I go on the internet, I notice a huge slowdown on my PC.
    >So we checked the running processes and some other status things, and it
    >turns out that our Norton Personal Firewall 2002 is getting a "Firewall
    >configuration updated" message 2-4 times per second! It used to only do
    >that once a day. Our Win98 machine is doing it too (the main PC is XP Pro
    >and we're sharing a DSL connection).

    As of WED 05-12 LiveUpdates.. NPF and it's associated routines have
    been VERY troublesome. One of the things that happened.. was the Win2k
    Wkstn slowed noticeably. Checking in Task Manager.. a Norton routine
    (perhaps redirector) was hogging one of the CPU's (50% on a dual-Xeon)

    Soon another update came out.. like the same day or the NEXT day for
    redirector. Ther are STILL issues when browsing like.. IE gets stuck
    in a localhost (127. ) loop and cannot be recovered short of a reboot.

    Often the NFW will repeatedly ask for permissions which no reply will
    satisfy. Then Win2k will bluescreen. Very annoying!!

    >
    >LiveUpdate still works, we don't have any viruses (the Symantec automatic
    >support said that we had MyDoom, but the removal tool didn't find it), and
    >things like ICQ and PuTTy still seem to work fine. If we don't have an IE
    >window open, everything is slow.
    >
    >Has anyone heard of this before? Is it just Norton's way of forcing an
    >upgrade? Our subscription is still valid.


    I wondered that as well.. so I uninstalled NPF and reinstalled from
    the CD.. then did about three simultaneous LiveUpdates. It has
    malfunctioned JUST ONCE since then.. and not in the last 1-2 days.

    One More ALICE.. and I'm yankin' it and going with ZA or SyGate!!


    -Mike
    , May 17, 2004
    #2
    1. Advertising

  3. Chuck,

    It's all over the place. You can find it being discussed at Computer Cops,
    at Wilders Security Forums and at the DSLR/BBR Security Forum. Seems like
    the LiveUpdate of 12 May (or maybe one thereafter) blew the socks off
    NIS/NPF 2002 (but people using NIS/NPF 2003 or 2004 appear to be okay).

    If you're bored, you can always try reading through the thread at
    http://www.dslreports.com/forum/remark,10248995~mode=flat (start about six
    posts in). <g>

    Firewall rules appear to be okay as do the basic configuration settings.
    Looks like one of the downloaded components is causing NIS/NPF 2002 to
    'burp'. There's a bit of suspicion that they inadvertently stuffed a
    NIS/NPF 2003/2004 update into the update for NIS/NPF 2002. No word (yet) on
    a fix for the fix. :-(

    Could be something they did to get a response out the door in short time in
    response to the eEYE vulnerabilities which also impact NIS/NPF 2002.
    (There's exploit code out for this now, so it sort of leaves people between
    a rock and a hard place.)

    I presume what you're seeing looks similar to the following?

    Firewall Event Log
    17/05/2004 03:14:31 Owner Firewall configuration updated: 64 rules
    17/05/2004 03:14:31 Owner Firewall configuration updated: 64 rules
    17/05/2004 03:14:31 Owner Firewall configuration updated: 64 rules
    17/05/2004 03:14:31 Owner Firewall configuration updated: 64 rules
    17/05/2004 03:14:31 Owner Firewall configuration updated: 64 rules
    17/05/2004 03:14:31 Owner Firewall configuration updated: 64 rules
    17/05/2004 03:14:31 Owner Firewall configuration updated: 64 rules
    17/05/2004 03:14:30 Owner Firewall configuration updated: 64 rules
    17/05/2004 03:14:28 Not Logged In Firewall configuration updated: 64 rules
    17/05/2004 03:14:26 Not Logged In NDIS filtering is enabled

    (That's for an XP box with NIS User Accounts enabled.)
    Joseph V. Morris, May 17, 2004
    #3
  4. Chuk Goodin

    Chuk Goodin Guest

    On Mon, 17 May 2004 15:16, "Joseph V. Morris" <> wrote:
    >If you're bored, you can always try reading through the thread at
    >http://www.dslreports.com/forum/remark,10248995~mode=flat (start about six
    >posts in). <g>


    Thanks, I'll look at that.

    >I presume what you're seeing looks similar to the following?

    [snip example]

    Yep, that's it exactly. It's hogging cycles and RAM like crazy, too.

    Thanks a lot for the quick responses -- Google and Symantec's "support"
    (such as it is for 1.5 year old programs) were getting me nowhere.



    --
    chuk
    Chuk Goodin, May 17, 2004
    #4
  5. Chuk Goodin

    Guest

    On Mon, 17 May 2004 15:16:37 -0400, "Joseph V. Morris"
    <> brought the following to our attention:

    >Chuck,
    >
    >It's all over the place. You can find it being discussed at Computer Cops,
    >at Wilders Security Forums and at the DSLR/BBR Security Forum. Seems like
    >the LiveUpdate of 12 May (or maybe one thereafter) blew the socks off
    >NIS/NPF 2002 (but people using NIS/NPF 2003 or 2004 appear to be okay).
    >
    >If you're bored, you can always try reading through the thread at
    >http://www.dslreports.com/forum/remark,10248995~mode=flat


    YES.. that's exactly what it's doing.. hogging CPU.. repeatedly asks
    for the same PERMISSION over-and-over.. not satisfied with ANY reply
    to a `permission'.. getting stuck in a localhost type loop.. requires
    a reboot to remedy.. and also bluescreens frequently!! Pretty
    serious situation. I uninstalled using the INSTALL CD menu.. then
    reinstalled and did about three LU's. Has since been behaving..
    somewhat that is!!

    -Mike

    >(start about six posts in). <g>
    >
    >Firewall rules appear to be okay as do the basic configuration settings.
    >Looks like one of the downloaded components is causing NIS/NPF 2002 to
    >'burp'. There's a bit of suspicion that they inadvertently stuffed a
    >NIS/NPF 2003/2004 update into the update for NIS/NPF 2002. No word (yet) on
    >a fix for the fix. :-(
    >
    >Could be something they did to get a response out the door in short time in
    >response to the eEYE vulnerabilities which also impact NIS/NPF 2002.
    >(There's exploit code out for this now, so it sort of leaves people between
    >a rock and a hard place.)
    >
    >I presume what you're seeing looks similar to the following?
    >
    >Firewall Event Log
    >17/05/2004 03:14:31 Owner Firewall configuration updated: 64 rules
    >17/05/2004 03:14:31 Owner Firewall configuration updated: 64 rules
    >17/05/2004 03:14:31 Owner Firewall configuration updated: 64 rules
    >17/05/2004 03:14:31 Owner Firewall configuration updated: 64 rules
    >17/05/2004 03:14:31 Owner Firewall configuration updated: 64 rules
    >17/05/2004 03:14:31 Owner Firewall configuration updated: 64 rules
    >17/05/2004 03:14:31 Owner Firewall configuration updated: 64 rules
    >17/05/2004 03:14:30 Owner Firewall configuration updated: 64 rules
    >17/05/2004 03:14:28 Not Logged In Firewall configuration updated: 64 rules
    >17/05/2004 03:14:26 Not Logged In NDIS filtering is enabled
    >
    >(That's for an XP box with NIS User Accounts enabled.)
    >
    , May 17, 2004
    #5
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Look in my eyes and you'll find me

    Norton Anti-Virus 2002. How Can i have emails scanned on entry to my inbox

    Look in my eyes and you'll find me, Aug 31, 2003, in forum: Computer Support
    Replies:
    4
    Views:
    560
  2. David

    Norton AntiVirus 2002

    David, Sep 15, 2003, in forum: Computer Support
    Replies:
    4
    Views:
    429
    Billh
    Sep 15, 2003
  3. bjones

    ICQ and Norton Personal Firewall 2002

    bjones, Dec 12, 2003, in forum: Computer Support
    Replies:
    2
    Views:
    500
    Conor
    Dec 13, 2003
  4. te2
    Replies:
    1
    Views:
    628
    ┬░Mike┬░
    Sep 2, 2004
  5. Theo Markettos

    VOIP over VPN over TCP over WAP over 3G

    Theo Markettos, Feb 3, 2008, in forum: UK VOIP
    Replies:
    2
    Views:
    805
    Theo Markettos
    Feb 14, 2008
Loading...

Share This Page