Firewall XP

[Mike Hall \(MS-MVP\)]

If you have a software firewall installed, eg. Zonealarm, McAfee, that will
automatically turn of the SP2 firewall..

 

[Guest]

I have just installed a second hard disk.

Everything has gone amazingly well except I now get a warning that the
Firewall is off.

I have tried switching it back on with no luck.

Has anyone got any ideas?


Thanks

RobM

 

[Guest]

Mike,

I don't have any other Firewall.

I have Sophos anti-virus and it hasn't reported any virus problems.

I am running the virus checker on the system but I don't expect any problems!

Rob

 

[MAP]

I have just installed a second hard disk.

Everything has gone amazingly well except I now get a warning that the
Firewall is off.

I have tried switching it back on with no luck.

Has anyone got any ideas?


Thanks

RobM

Stop using the native firewall.Use this one instead.
http://smb.sygate.com/free/spf_download.php


The rest of this post is taken from the Oct 27 newsletter from
www.spywareinfo.com


I promised myself a while back not to go on another anti-Microsoft rant,
that I would write calmly about any goofs they make. It has been a hard
promise to keep at times. And now, I must break that promise. If I don't
rant about this, I will burst at the seams.

The function of a software firewall is simple. It allows the user to control
the computer's access to other computers. To do that, it blocks attempts to
send unauthorized data out over a network, as well as the attempts of other
computers to send data to the protected computer. A proper firewall allows
data into or out of the computer, only when the user gives the firewall
permission to do so. I think most people will agree that this is an accurate
description of the proper function of a software firewall.

So I am left to wonder if the Microsoft programmers who designed the Windows
Firewall have lost their freakin minds. While the Windows Firewall will
block network access like any other firewall, the settings which determine
whether or not an attempt to access the network is permitted is stored in
the registry. Any piece of software is allowed to edit that part of the
registry and give itself permission to send or receive data over the
network.

There are several viruses, worms and spyware programs that edit the registry
settings for the Windows Firewall. Even if the user discovers a virus
infection and cleans it successfully, that computer can be reinfected at any
time, if the virus edited the firewall settings. Many network worms can
infect a computer if it discovers certain unsecured network ports. It
happened to me once, when I turned off my firewall and forgot to turn it
back on.

Changes to a firewall's settings should be possible only through the
firewall program's interface. Those changes should be saved into an
encrypted file, which cannot be altered by any other program. Those settings
should not EVER be written to the registry, where they can be altered by any
other program running on the PC. It takes only the smallest shred of common
sense to realize this.

Where was the common sense when they were creating the Windows Firewall?
This is like hiring security guards to keep gate crashers away from a party
but allowing the guests to write their own invitations.

But wait, there's more!

Someone discovered recently that the Windows Firewall interface won't even
tell the user about an opened port, if the registry entry granting it
permission has a malformed name. Not only can a malicious programmer give
his evil creation permission to bypass the firewall, he can hide the fact
that he's done it!

It is boneheaded mistakes like this which make it difficult to use Windows
safely. God help us all when Microsoft begins to make its own antivirus
software. The only reason Microsoft's antispyware program works well
probably is because Microsoft didn't write it.

 

[Segovia]

Stop using the native firewall.Use this one instead.
http://smb.sygate.com/free/spf_download.php

It does not add any real security, and just creates more problems. Mainly
- asking the user questions that they do not understand, and which really
only give the user the warm fuzzy feeling that he is protecting himself and
in control:

"!!!!!FIREFOX.EXE IS ATTEMPTING TO ACCESS THE INTERNET. DO YOU WANT TO
ALLOW THIS POTENTIALLY DANGEROUS ACTION OR DENY IT??????"

Well of course I want to allow it. Why in the world would I install a web
browser if I didn't want it to access the internet? If I don't want it to
access the internet, I won't launch it, or install it in the first place.

The rest of this post is taken from the Oct 27 newsletter from
www.spywareinfo.com

I realize you didn't write this part, but wanted to make some comments on
it.

[snip]

So I am left to wonder if the Microsoft programmers who designed the Windows
Firewall have lost their freakin minds. While the Windows Firewall will
block network access like any other firewall, the settings which determine
whether or not an attempt to access the network is permitted is stored in
the registry. Any piece of software is allowed to edit that part of the
registry and give itself permission to send or receive data over the
network.

Presumably you would like the software you install to work properly? If
you don't want it to access the internet, you would configure it that way
when you install it. Why would you install a software that you do not
trust, or a software that accesses the internet without your consent?

There are several viruses, worms and spyware programs that edit the registry
settings for the Windows Firewall. Even if the user discovers a virus
infection and cleans it successfully, that computer can be reinfected at any
time, if the virus edited the firewall settings. Many network worms can
infect a computer if it discovers certain unsecured network ports. It
happened to me once, when I turned off my firewall and forgot to turn it
back on.

Silly argument. If the computer is infected by a virus or worm, it can do
FAR worse things than "edit the registry settings for the Windows
Firewall"... and it can certainly disable or edit the configuration of ANY
firewall. Nearly all of the newer viruses will disable antivirus and
firewalls. Why would you think that they can only edit the MS firewall
settings?

Changes to a firewall's settings should be possible only through the
firewall program's interface. Those changes should be saved into an
encrypted file, which cannot be altered by any other program. Those settings
should not EVER be written to the registry, where they can be altered by any
other program running on the PC. It takes only the smallest shred of common
sense to realize this.

Another silly argument. Do you really think that preventing access to the
config files will prevent the firewall from being sabotaged? Surely you
know that any program can be disabled by many other ways than editing the
program's own config files.

Where was the common sense when they were creating the Windows Firewall?
This is like hiring security guards to keep gate crashers away from a party
but allowing the guests to write their own invitations.

But wait, there's more!

Someone discovered recently that the Windows Firewall interface won't even
tell the user about an opened port, if the registry entry granting it
permission has a malformed name. Not only can a malicious programmer give
his evil creation permission to bypass the firewall, he can hide the fact
that he's done it!

Utter nonsense. Again, if you are installing software that you do not
trust, or do not know what it does, you have far worse things to worry
about than it bypassing your software firewall. It's trivial for malware
to disable ANY software firewall.

It is boneheaded mistakes like this which make it difficult to use Windows
safely. God help us all when Microsoft begins to make its own antivirus
software. The only reason Microsoft's antispyware program works well
probably is because Microsoft didn't write it.

More FUD and nonsense. Basically what this writer is expecting is that he
can install any PoS/unknown software/malware and that his software firewall
will save him from himself. That won't work.