Hi,

I really do like this site; I think it's the font of most computer knowledge in the universe.

I'm pretty sure my malware is all gone; Mickiemoes has been helping me in the HJT forum. My logs are clean, I set a restore point, and so far, I like the Antivir he suggested for a virus checker. He also helped me get rid of Norton, which didn't want to go away. So, now I'm trying out other free firewalls recommended by BC, one at a time. I'm using Kerio's version now and it seems OK. But . . .

My problem: I have Kerio set to prompt me about everything, just because I'm curious. Often, when I'm away from the computer, I'll "disable all traffic" or sometimes just log off. When I get back, I still find a lot of things that wanted internet access - much of it apparently from Microsoft. Just now, I got "direct 3D Flying Objects Screen Saver", supposedly launched by Windows NT Logon Application wanting to call out. But, I don't even *use* a screen saver. I denied everything manually, but don't want to create rules until I actually know what I'm doing.

Norton never used to alert me to things like this - in fact I had no idea Microsoft wanted to "phone home" as often as it apparently does. Is this a flaw with Kerio, or did Norton just let Microsoft bypass their firewall when it wanted to? If so, is this usually benign? If not, is there a tutorial somewhere to help me decide what to permanently try to block and what to allow? Was there one here that I missed?

Thanks again.

aelfgifa

You may be seeing attempts by one programme to access another internally.
Can you provide the exact wording next time this happens?
Regards,
John

Hello again,

Well, darn. I've been watching and it hasn't happened again. Maybe it is a scheduled thing. I'm still running Kerio in paranoia mode where I want to be asked about everything, until I feel OK with creating rules to permit things. Especially when I'm not sure what I'm permitting. I haven't been able to install the help file so have been googling a lot.

re the above (on the screensavers), that was kind of bizarre because I quoted it as best I could. And I've never used a screen saver because I just don't like them (my personal taste only - no offense intended to anybody who loves them). I tried to do a "prt scrn" of the error message but it didn't work. If I get any more messages that claim to be from MS calling home, I'll figure out a way to record them.

Other than than, I like Kerio most of the time. And just getting rid of Norton Internet Security has made my computer boot up and run noticeably faster. So I guess I'll have to just wait and see.

Thanks,

aelfgifa

aelfgifa,

Does Kerio Firewall create logs? I would think they do so that those who don't] use the "paranoia" settings will still be able to find out what was blocked. If so, you can find the messages in the logs. If there aren't any logs, it may be that you have to enable the logs, do you remember doing so?

Orange Blossom

Hi Orange Blossom,

That was actually something I thought of, but haven't been able to find them. Since I don't have the help file either, I'm thinking of just trying a fresh install tomorrow. I searched this forum and some other ones and haven't seen similar problems. So either I had a problem/power glitch when I downloaded it or I didn't enable the logs. Is there an obvious way to find this out, without the help file?

Other than that, I think I will eventually be happy with it. It's not real intrusive and seems to play nicely with all my other programs, which Norton just didn't. (I have some graphics programs I'm trying to learn, but am not that good yet).

Would it be a better idea to reinstall or try some more to figure out how to enable the logs? I don't really want to do the paranoia mode forever. I was just curious about what programs wanted internet access because my other computer somehow got hijacked and was being used to send out spam. And the nasty stuff was bouncing back to me. Yuck.

aelfgifa

Have you seen the PDF document here:
Kerio Personal Firewall User's Guide
It's the first one at the top.

Great job tg1911 . I've been trying to find an online user's manual so I could post it.

aelfgifa: The information about how to access the logs can be found in section 11 beginning on page 106. If you have Adobe Reader or Foxit Reader - which is the one I prefer - you can download and print out the entire manual. I find it easier to read hard copies, especially when following a set of directions while offline.

Good Luck,

Orange Blossom

Thank you tg1911 and Orange Blossom,

That pdf file is exactly what I've been looking for. How I missed it, I don't know. I think I can figure out what I need to do from here. And I like Foxit for a pdf reader also; that's what I have installed now.

Thanks again everybody for the help.

aelfgifa

You're welcome, aelfgifa.
I hope it helps in answering your questions.