Guarding against blended threats

Internet Worm Protection prevents certain network worms and other Internet threats from attacking your computer by employing inbound port blocking (which utilizes known worm signatures) and network monitoring methods.

Internet Worm Protection also provides proactive protection against new threats by blocking attacks from entire categories of worms and viruses, rather than just the individual emerging threats.

More Information

Checking Internet Worm Protection settings

About rule processing

Customizing worm signature detection

Customizing Program Rules

Customizing General Rules

Customizing AutoBlock


Checking Internet Worm Protection settings

While the default settings provide maximum protection from worms and other Internet threats, these settings are customizable. You can control some Internet Worm Protection functions using the Norton AntiVirus tab.

To check Internet Worm Protection settings

  1. In the main window, click the Norton AntiVirus tab.

  2. Open the Settings bar.

  3. Select the action that you want to take. Your option are:

    Turn On or Turn Off

    Turn on or turn off Spyware Protection.

    Configure

    Set Spyware Protection options.

    Restore

    Restore a quarantined security risk if another program needs it in order to function.


About rule processing

Rules are processed in a set order that is based on their types. General Rules are processed first, followed by Program Rules. Within the list of General Rules, rules are processed in order of appearance, from top to bottom. Program Rules are not processed in order, but the rules within each Program Rule are processed in order of appearance, from top to bottom.

Once a rule that blocks or permits communication is matched, all of the remaining rules are ignored. Additional rules that match this type of communication are ignored if they appear below the first rule that matches.

For example, you may have a rule that blocks the use of Symantec pcAnywhere on your computer. If you add a rule that permits the use of Symantec pcAnywhere with a specific computer, and then you move the new rule higher in the list, the new rule lets you use Symantec pcAnywhere with that specific computer. The other rule prevents its use with any other computer. If no matching rule is found, the communication is blocked.


Customizing worm signature detection

In some cases, benign network activity may appear similar to an attack signature. A signature is a unique string of bits, or the binary pattern, of a worm. Like a fingerprint, it can be used to detect and identify specific worms. If you receive repeated warnings about possible attacks, and you know that these warnings are being triggered by safe behavior, you can create an exclusion for the attack signature that matches the benign activity.

Each exclusion that you create leaves your computer vulnerable to attacks. Be very selective when excluding attacks. Only exclude behavior that is always benign.

To exclude a worm signature

  1. In the main window, click the Norton AntiVirus tab.

  2. Open the Settings bar.

  3. Click Virus and Spyware Protection options .

  4. In the Virus and Spyware Protection Options window, in the left pane, under Real-Time Protection, click Internet Worm Protection.

  5. In the Real-Time Protection: Internet Worm Protection window, click Configure Exclusions.

  6. In the Signature Exclusions dialog box, uncheck the signatures that you want to exclude.

  7. Click OK to close the window.

To include a worm signature

  1. In the main window, click the Norton AntiVirus tab.

  2. Open the Settings bar.

  3. Click Virus and Spyware Protection options.

  4. In the Virus and Spyware Protection Options window, in the left pane, under Real-Time Protection, click Internet Worm Protection

  5. In the Real-Time Protection: Internet Worm Protection window, click Configure Exclusions.

  6. In the Signature Exclusions dialog box, check the signatures that you want to include.

  7. Click OK to close the window.

    LiveUpdate obtains and automatically installs the latest worm signatures for Internet Worm Protection.


Customizing Program Rules

You can quickly customize settings that block or permit inbound access to programs on your computer.

More Information

Creating a Program Rule

Changing a Program Rule

Removing a Program Rule


Creating a Program Rule

Create a Program Rule to strictly control inbound access to a program on your computer.

To create a Program Rule

  1. In the main window, click the Norton AntiVirus tab.

  2. Click the Settings bar.

  3. Click Virus and Spyware Protection options.

  4. In the Virus and Spyware Protection Options window, in the left pane, under Real-Time Protection, click Internet Worm Protection.

  5. In the Real-Time Protection: Internet Worm Protection window, click Program Control.

  6. In the Program Rules dialog box, click Add.

  7. Select the program's executable file.

  8. Click Open.

  9. In the Program Control notification, assign an access level to your program. Your options are:

    Automatically configure Internet access (Recommended)

    Allow Internet Worm Protection to automatically configure access. This option is available only for programs that appear on the Symantec Trusted Application list.

    Allow

    Permit inbound access to this program. This is not as safe as automatically configuring Internet access, but it is appropriate for many programs that are not recognized. If you recognize the program and trust it to be safe, select this option.

    Block

    Block any inbound access to the selected program. Select this option if you do not recognize the program and the risk is high.

    Manually configure Internet access

    Customize inbound access for this program. Select this option if you understand how the program accesses the Internet.

  10. Click OK.


Changing a Program Rule

You can change access settings for certain programs. The steps necessary to change a Program Rule are similar to those required to create a Program Rule.

To change a Program Rule

  1. In the main window, click the Norton AntiVirus tab.

  2. Click the Settings bar.

  3. Click Virus and Spyware Protection options.

  4. In the Virus and Spyware Protection Options window, in the left pane, under Real-Time Protection, click Internet Worm Protection.

  5. In the Real-Time Protection: Internet Worm Protection window, click Program Control.

  6. Under Access, in the drop-down list next to the program for which you want to modify access, assign an access level to your program. Your options are:

    Allow

    Permit all access attempts to this program.

    Block

    Deny all access attempts to this program.

    Custom

    Create a rule that controls how this program is accessed.

    Auto

    Allow Internet Worm Protection to configure Internet access for the program without your intervention.

  7. Click OK.


Removing a Program Rule

If you find that you no longer require a Program Rule, you can easily remove it. For example, if you uninstall a program, you can remove any rules that you have created for that program.

To remove a Program Rule

  1. In the main window, click the Norton AntiVirus tab.

  2. Click the Settings bar.

  3. Click Virus and Spyware Protection options

  4. In the Virus and Spyware Protection Options window, in the left pane, under Real-Time Protection, click Internet Worm Protection.

  5. In the Real-Time Protection: Internet Worm Protection window, click Program Control.

  6. In the Program list, select a program.

  7. Click Remove.


Customizing General Rules

General Rules in Internet Worm Protection monitor communications between your computer and other computers on the Internet. The default rules should provide adequate protection for most users. If the default protection is not appropriate, then you can create and customize your own rules.

Modification of General Rules can have unexpected results and should be performed with extreme caution.

More Information

About General Rules

Creating a General Rule

Changing a General Rule

Removing a General Rule


About General Rules

General Rules control how Internet Worm Protection protects your computer from worms and malicious incoming traffic and programs. Internet Worm Protection automatically checks all data coming into your computer against these rules.

General Rules are predefined and enabled in Internet Worm Protection. These rules provide basic network functionality as well as protect you from known Internet risks. The default settings for General Rules include the following:

Default Inbound ICMP | Permits safe types of inbound ICMP messaging. ICMP messages provide status and control information. For example, the PING command uses ICMP to test an Internet connection.
Default Inbound NetBIOS | Controls the use of the NetBIOS datagram service, which is used in file sharing on the Microsoft Network.
Default Block Inbound ICMP | Blocks all other inbound ICMP messaging not listed in the Default Inbound ICMP rule.
Default Inbound BOOTP | Permits the use of the BOOTP service. Bootstrap Protocol enables a computer to discover its own IP address. This rule is also required to receive Internet Protocols (IPs) via Dynamic Host Configuration Protocol (DHCP).
Default Block Microsoft Windows 2000 SMB | Blocks Microsoft Windows Server Message Block, which is a message format used by DOS and Windows to share files, directories and devices.
UPnP Port 5000 Block Rule | Blocks Universal Plug and Play port 5000. Universal Plug and Play is a networking architecture that provides compatibility among networking equipment, software and peripherals. UPnP is device-driver independent and requires no network configuration.
UPnP Port 1900 Block Rule | Blocks Universal Plug and Play port 1900.
Default Inbound DNS | Permits the use of the Domain Name System (DNS).
Default Inbound NetBIOS Name | Controls the use of the NetBIOS name service, which is used in file and printer sharing on the Microsoft Network.
Block Windows File Sharing | Blocks Windows file sharing, a protocol to exchange files on a Windows Network.


Creating a General Rule

Internet Worm Protection lets you define your own General Rules.

To write a General Rule

  1. In the main window, click the Norton AntiVirus tab.

  2. Open the Settings bar.

  3. Click Virus and Spyware Protection options.

  4. In the Virus and Spyware Protection Options window, in the left pane, under Real-Time Protection, click Internet Worm Protection.

  5. In the Real-Time Protection: Internet Worm Protection window, click General Rules.

  6. In the General Rules dialog box, click Add.

  7. Follow the instructions in the Add Rule wizard.


Changing a General Rule

You can change General Rules if they are not functioning in the way that you want.

To change a General Rule

  1. In the main window, click the Norton AntiVirus tab.

  2. Open the Settings bar.

  3. Click Virus and Spyware Protection options.

  4. In the Real-Time Protection: Internet Worm Protection window, click General Rules.

  5. In the General Rules window, select the rule that you want to change.

  6. Click Modify.

  7. Follow the on-screen instructions to change any aspect of the rule.

  8. When you have finished changing the rule, click OK.

Each list of General Rules is processed from the top down. You can change the way in which rules are processed by changing their order.

To change the order of General Rules

  1. In the main window, click the Norton AntiVirus tab.

  2. Open the Settings bar.

  3. Click Virus and Spyware Protection options.

  4. In the Virus and Spyware Protection Options window, in the left pane, under Real-Time Protection, click Internet Worm Protection.

  5. In the Real-Time Protection: Internet Worm Protection window, click General Rules.

  6. In the General Rules window, select the rule that you want to move.

  7. Select the action that you want to take. Your options are:

    Move Up

    Process this rule before the rule above it.

    Move Down

    Process this rule after the rule below it.

  8. When you have finished moving the rules, click OK.


Removing a General Rule

You can remove General Rules when they are no longer necessary.

To remove a General Rule

  1. In the main window, click the Norton AntiVirus tab.

  2. Open the Settings bar.

  3. Click Virus and Spyware Protection options.

  4. In the Virus and Spyware Protection Options window, in the left pane, under Real-Time Protection, click Internet Worm Protection.

  5. In the Real-Time Protection: Internet Worm Protection window, click General Rules.

  6. In the General Rules window, select the rule that you want to remove.

  7. Click Remove.

  8. When you have finished removing rules, click OK.


Customizing AutoBlock

If AutoBlock is on and Internet Worm Protection determines that a recent incoming communication attempt may have been part of an attack, it automatically blocks all communication with this computer for 30 minutes.

Occasionally, normal activity might be interpreted as an attack. If you are unable to communicate with a specific computer, see if it is on the list of computers currently blocked by AutoBlock. Internet Worm Protection lets you manually unblock the computer's IP address at any time.

To prevent a computer attack from the Internet, turn on AutoBlock.

To turn on AutoBlock

  1. In the main window, click the Norton AntiVirus tab.

  2. Open the Settings bar.

  3. Click Virus and Spyware Protection options.

  4. In the Virus and Spyware Protection Options window, in the left pane, under Real-Time Protection, click Internet Worm Protection.

  5. In the Real-Time Protection: Internet Worm Protection window, click AutoBlock.

  6. In the AutoBlock dialog box, check On (recommended).

Remove computers from the AutoBlock list when they no longer pose a threat.

To remove computers from the AutoBlock list

  1. In the main window, click the Norton AntiVirus tab.

  2. Open the Settings bar.

  3. Click Virus and Spyware Protection options.

  4. In the Virus and Spyware Protection Options window, in the left pane, under Real-Time Protection, click Internet Worm Protection.

  5. In the Real-Time Protection: Internet Worm Protection window, click AutoBlock.

  6. In the AutoBlock dialog box, select a computer.

  7. Click Unblock.

To remove all computers from the AutoBlock list

  1. In the main window, click the Norton AntiVirus tab.

  2. Open the Settings bar.

  3. Click Virus and Spyware Protection options.

  4. In the Virus and Spyware Protection Options window, in the left pane, under Real-Time Protection, click Internet Worm Protection.

  5. In the Real-Time Protection: Internet Worm Protection window, click AutoBlock.

  6. In the AutoBlock dialog box, select a computer.

  7. Click Unblock All.