Home » McAfee Manuals » Computer Software » McAfee MIS80E001RAI » Manual Viewer

McAfee MIS80E001RAI User Guide - Page 53

Record Intrusion Detection IDS Events in Inbound Events Log, Outbound Only access.

UPC - 731944547817

View all McAfee MIS80E001RAI manuals

Add to My Manuals
Save this manual to your list of manuals

Page 53 highlights

Setting the security level Tight Security - When an application requests a specific type of access to the Internet (for example, Outbound Only Access), you can allow or disallow the application an Internet connection. If the application later requests Full Access, you can then grant Full Access or restrict it to Outbound Only access. Standard Security (recommended) - When an application requests and then is granted Internet access, the application receives full Internet access to handle incoming and outgoing traffic. Trusting Security - All applications are automatically trusted when they first attempt to access the Internet. However, you can configure Personal Firewall to use alerts to notify you about new applications on your computer. Use this setting if you find that some games or streaming media do not work. Open - Your firewall is disabled. This setting allows all traffic through Personal Firewall, without filtering. NOTE Previously blocked applications continue to be blocked when the firewall is set to the Open or Lockdown security setting. To prevent this, you can either change the application's permissions to Allow Full Access or delete the Blocked permission rule from the Internet Applications list. 4 Select additional security settings: NOTE If your computer runs Windows XP and multiple XP users have been added, these options are available only if you are logged on to your computer as an administrator. Record Intrusion Detection (IDS) Events in Inbound Events Log - If you select this option, events detected by IDS will appear in the Inbound Events log. The Intrusion Detection System detects common attack types and other suspicious activity. Intrusion detection monitors every inbound and outbound data packet for suspicious data transfers or transfer methods. It compares these to a "signature" database and automatically drops the packets coming from the offending computer. IDS looks for specific traffic patterns used by attackers. IDS checks each packet that your machine receives to detect suspicious or known-attack traffic. For example, if Personal Firewall sees ICMP packets, it analyzes those packets for suspicious traffic patterns by comparing the ICMP traffic against known attack patterns. User Guide 53

Section	Page
Quick Start Card	3
Introduction	11
McAfee Internet Security software	12
System requirements	12
Supported e-mail programs	13
Toolbar plug-in requirements	13
Supported instant messaging programs	13
Using McAfee SecurityCenter	13
Removing Internet Security Suite programs	15
McAfee VirusScan	17
New features	17
Testing VirusScan	19
Testing ActiveShield	19
Testing Scan	19
Using McAfee SecurityCenter	21
Using ActiveShield	21
Enabling or disabling ActiveShield	21
Enabling ActiveShield	22
Disabling ActiveShield	23
Configuring ActiveShield options	23
Starting ActiveShield	23
Stopping ActiveShield	24
Scanning e-mail and attachments	24
Scanning for worms	26
Scanning inbound instant message attachments	28
Scanning all files	28
Scanning program files and documents only	29
Scanning for new unknown viruses	29
Scanning for scripts	30
Scanning for Potentially Unwanted Programs (PUPs)	31
Understanding security alerts	32
Managing detected files	32
Managing detected e-mail	33
Managing suspect scripts	33
Managing potential worms	33
Managing PUPs	34
Manually scanning your computer	35
Manually scanning for viruses and other threats	35
Scanning via Windows Explorer	38
Scanning via Microsoft Outlook	38
Automatically scanning for viruses and other threats	38
Understanding threat detections	40
Managing quarantined files	41
Creating a Rescue Disk	43
Write-protecting a Rescue Disk	44
Using a Rescue Disk	44
Updating a Rescue Disk	44
Automatically reporting viruses	44
Reporting to the World Virus Map	45
Viewing the World Virus Map	46
Updating VirusScan	47
Automatically checking for updates	47
Manually checking for updates	47
McAfee Personal Firewall Plus	49
New features	49
Removing other firewalls	51
Setting the default firewall	51
Setting the security level	52
Testing McAfee Personal Firewall Plus	54
Using McAfee SecurityCenter	54
About the Summary page	55
About the Internet Applications page	60
Changing application rules	61
Allowing and blocking Internet applications	61
About the Inbound Events page	62
Understanding events	63
About IP addresses	63
Events from 0.0.0.0	63
Events from 127.0.0.1	63
Events from computers on your LAN	64
Events from private IP addresses	64
Showing events in the Inbound Events log	65
Showing today's events	65
Showing this week's events	65
Showing the complete Inbound Events log	65
Showing events from a specific day	66
Showing events from a specific Internet address	66
Showing events that share identical event information	67
Responding to inbound events	67
Tracing the selected event	67
Getting advice from HackerWatch.org	67
Reporting an event	68
Signing up for HackerWatch.org	68
Trusting an address	68
Banning an address	69
Managing the Inbound Events log	71
Archiving the Inbound Events log	71
Viewing an archived Inbound Events log	71
Clearing the Inbound Events log	71
Copying an event to the Clipboard	72
Deleting the selected event	72
About alerts	72
Red alerts	73
Internet Application Blocked alert	73
Application Wants to Access the Internet alert	75
Application Has Been Modified alert	76
Application Requests Server Access alert	77
Green alerts	78
Application Allowed to Access the Internet alert	78
Application Has Been Modified alert	79
Blue alerts	80
Connection Attempt Blocked alert	80
McAfee Privacy Service	81
Features	81
The Administrator	81
Setting up Privacy Service	82
Setting up a Pre-installed version of Privacy Service	82
Retrieving the Administrator Password	83
Removing Privacy Service with Safe Mode	83
The Startup user	84
Configuring the Administrator as Startup User	84
Using McAfee SecurityCenter	84
Launching McAfee Privacy Service	85
Launching and signing in to Privacy Service	85
Disabling Privacy Service	85
Updating McAfee Privacy Service	85
Removing and Re-installing Privacy Service	86
Removing Privacy Service	87
Installing Privacy Service	87
Setting the password	88
Setting the age group	88
Setting the cookie blocker	88
Setting the Internet Time limits	89
Creating Web Site Permissions with Keywords	89
Changing passwords	90
Changing a user’s information	91
Changing cookie blocker setting	91
Editing the Accept and Reject Cookie List	91
Changing the age group	92
Changing Internet time Limits	92
Changing the Startup user	93
Removing users	93
Blocking Web sites	93
Allowing Web sites	93
Blocking information	94
Adding information	94
Editing information	94
Removing personal information	94
Blocking Web bugs	95
Blocking advertisements	95
Allowing cookies from specific Web sites	96
Date and time	96
User	96
Summary	96
Event Details	96
Saving the Current Log	96
Viewing Saved Logs	97
Erasing files permanently using McAfee Shredder	97
Why Windows leaves file remnants	98
What McAfee Shredder erases	98
Permanently erasing files in Windows Explorer	98
Emptying the Windows Recycle Bin	98
Customizing Shredder settings	98
Backing up the Privacy Service database	99
Restoring the Backup Database	99
Changing your password	100
Changing your user name	100
Clearing your cache	101
Accepting cookies	101
If you need to remove a web site from this list:	101
Rejecting cookies	102
If you need to remove a web site from this list:	102
McAfee SpamKiller	103
User options	103
Filtering	103
Features	104
Understanding the top pane	104
Understanding the Summary page	105
Microsoft Outlook and Outlook Express integration	105
Using McAfee SecurityCenter	106
Disabling SpamKiller	107
Adding e-mail accounts	107
Adding an e-mail account	108
Pointing your e-mail client to SpamKiller	108
Deleting e-mail accounts	109
Deleting an e-mail account from SpamKiller	109
Editing e-mail account properties	109
POP3 accounts	109
Editing POP3 accounts	109
MSN/Hotmail accounts	112
Editing MSN/Hotmail accounts	112
MAPI accounts	113
Editing MAPI accounts	114
Adding users	115
User passwords and protecting children from spam	116
Creating a password for an existing SpamKiller user	116
Adding a user to SpamKiller	116
Editing SpamKiller user profile	117
Deleting a SpamKiller user profile	117
Logging on to SpamKiller in a multi-user environment	117
Switching between users	117
Opening a Friends List	119
Importing address books	119
Importing an address book by automatic import	120
Importing an address book manually	120
Editing address book information	121
Deleting an address book from the automatic import list	121
Adding friends	122
Adding friends from the Blocked E-mail or Accepted E-mail page	122
Adding friends from the Friends page	123
Adding friends from Microsoft Outlook	123
Editing friends	123
Deleting friends	124
Blocked E-mail page	125
Accepted E-mail page	127
Tasks for Blocked E-mail and Accepted E-mail	128
Rescuing messages	129
From the Blocked E-Mail page	129
From the SpamKiller folder in Microsoft Outlook or Outlook Express	129
Blocking messages	129
From the Accepted E-mail page	129
From Microsoft Outlook	130
Where are the blocked messages	130
Deleting a message manually	130
Modifying how spam messages are processed	130
Tagging	130
Blocking	130
Modifying how SpamKiller processes spam messages	131
Using the AntiPhishing filter	131
Adding friends to a Friends List	132
Adding filters	132
Regular expressions	134
Reporting spam to McAfee	137
Sending complaints manually	137
Sending error messages	137
Sending an error message manually	138
SpamKiller is unable to communicate with its server	138
Starting the SpamKiller server manually	138
SpamKiller server is blocked by firewalls or internet filtering programs	138
Cannot connect to the e-mail server	139
Verifying your connection to the Internet	139
Dial-up Users	139
Broadband (Cable, DSL)	139
Verifying the POP3 server address for SpamKiller	139

Match case Limit results 1 per page

User Guide

Setting the security level

Tight Security

—

When an application requests a specific type of access to

the Internet (for example, Outbound Only Access), you can allow or

disallow the application an Internet connection. If the application later

requests Full Access, you can then grant Full Access or restrict it to

Outbound Only access.

Standard Security (recommended)

—

When an application requests and

then is granted Internet access, the application receives full Internet access

to handle incoming and outgoing traffic.

Trusting Security

—

All applications are automatically trusted when they

first attempt to access the Internet. However, you can configure Personal

Firewall to use alerts to notify you about new applications on your

computer. Use this setting if you find that some games or streaming media

do not work.

Open

—

Your firewall is disabled. This setting allows all traffic through

Personal Firewall, without filtering.

NOTE

Previously blocked applications continue to be blocked when

the firewall is set to the

Open

Lockdown

security setting. To

prevent this, you can either change the application's

permissions to

Allow Full Access

or delete the

Blocked

permission rule from the

Internet Applications

list.

Select additional security settings:

NOTE

If your computer runs Windows XP and multiple XP users

have been added, these options are available only if you are

logged on to your computer as an administrator.

Record Intrusion Detection (IDS) Events in Inbound Events Log

—

If you

select this option, events detected by IDS will appear in the Inbound

Events log. The Intrusion Detection System detects common attack types

and other suspicious activity. Intrusion detection monitors every inbound

and outbound data packet for suspicious data transfers or transfer

methods. It compares these to a “signature” database and automatically

drops the packets coming from the offending computer.

IDS looks for specific traffic patterns used by attackers. IDS checks each

packet that your machine receives to detect suspicious or known-attack

traffic. For example, if Personal Firewall sees ICMP packets, it analyzes

those packets for suspicious traffic patterns by comparing the ICMP traffic

against known attack patterns.