Welcome to McAfee Personal Firewall Plus

McAfee Personal Firewall Plus

Welcome to McAfee Personal Firewall Plus.

Personal Firewall offers advanced protection for your computer and your personal data. Personal Firewall establishes a barrier between your computer and the Internet, silently monitoring Internet traffic for suspicious activities.

With it, you get the following features:

  • Defends against potential hacker probes and attacks
  • Complements anti-virus defenses
  • Monitors Internet and network activity
  • Alerts you to potentially hostile events
  • Provides detailed information on suspicious Internet traffic
  • Integrates HackerWatch.org functionality, including event reporting, self-testing tools and the ability to email reported events to other online authorities
  • Provides detailed tracing and event research features


New features

This version of Personal Firewall provides the following new features:

  • Improved Gaming Support

Personal Firewall protects your computer from intrusion attempts and suspicious activities during full-screen gameplay, but can hide alerts if it detects intrusion attempts or suspicious activities. Red Alerts appear after you exit the game.

  • Enhanced Access Handling

Personal Firewall lets you dynamically grant applications temporary access to the Internet. Access is restricted to the time the application launches until the time it closes.

  • Enhanced Security Options

Running the Lockdown feature in Personal Firewall allows you to instantly block all incoming and outgoing Internet traffic between your computer and the Internet. You can enable and disable Lockdown from multiple locations in Personal Firewall.

  • Improved Restore Capability

Personal Firewall allows you to automatically restore the default settings to Personal Firewall by running running Reset Options. If Personal Firewall exhibits undesirable behavior that you cannot correct, you can choose to undo your current settings and revert to the product's default settings.

  • Internet Connectivity Protection

To prevent you from inadvertently disabling your Internet connection, Personal Firewall hides the option to ban a connection in a Blue Alert when the IP of the incoming Internet connection has been assigned by a DHCP or DNS server. If the source of the incoming connection does not resolve to a DHCP or DNS server, the option appears. You can still ban any connection from the Banned IP Addresses page.

  • Enhanced HackerWatch.org Integration

    • Reporting potential hackers is easier than ever. Personal Firewall improves the functionality of HackerWatch.org, which includes event submission of potentially malicious events to the database.

  • Extended Intelligent Application Handling

    • When an application seeks Internet access, Personal Firewall first checks whether it recognizes the application as trusted or malicious. If the application is recognized as trusted, Personal Firewall can automatically allow it access to the Internet.

  • Advanced Trojan Detection

    • Personal Firewall combines application connection management with an enhanced database to detect and block more potentially malicious applications, such as Trojans, from accessing the Internet and potentially relaying your personal data.

  • Improved Visual Tracing

    • Visual Trace includes easy-to-read graphical maps showing the source of hostile attacks and traffic worldwide. It includes detailed contact/owner information and geographical data for originating IP addresses. Visual Trace allows users to visually track where intrusions originate, and with this new data, users are able to see a better graphical representation of their searches.

  • Improved Usability

    • Personal Firewall includes a Setup Assistant and a User Tutorial to guide users in the setup and use of their firewall. Although the product is designed to use without any intervention, McAfee provides users with a wealth of resources to understand and appreciate what the firewall provides for them.

  • Improved Intrusion Prevention

    • Personal Firewall protects your privacy more than ever by providing intrusion prevention of possible Internet threats. Using heuristic-like functionality, McAfee provides a tertiary layer of protection by blocking items that display symptoms of attacks or characteristics of hack attempts.

  • Enhanced Traffic Analysis

    • Personal Firewall offers users a view of both incoming and outgoing data from their computers, as well as displaying application connections including applications that are actively "listening" for open connections. This allows users to see and act upon applications that might be open for intrusion.


System requirements

  • Microsoft® Windows 98, Windows Me, Windows 2000, or Windows XP
  • Personal computer with Pentium-compatible processor
    Windows 98, 2000: 133 MHz or higher
    Windows Me: 150 MHz or higher
    Windows XP (Home and Pro): 300 MHz or higher
  • RAM
    Windows 98, Me, 2000: 64 MB
    Windows XP (Home and Pro): 128 MB
  • 40 MB hard disk space
  • Microsoft® Internet Explorer 5.5 or later

Note: To upgrade to the latest version of Internet Explorer, visit the Microsoft Web site at http://www.microsoft.com/.


Setting the default firewall

Personal Firewall can manage permissions for Internet applications on your computer, even if Windows Firewall is running on your computer.

When installed, Personal Firewall automatically disables Windows Firewall and sets itself as your default firewall. You then experience only Personal Firewall functionality and messaging. If you subsequently enable Windows Firewall via Windows Security Center or Windows Control Panel, letting both firewalls run on your computer might result in partial loss of logging in Personal Firewall as well as duplicate status and alert messaging.

Note: If both firewalls are enabled, Personal Firewall does not show all the blocked IP addresses in its Inbound Events tab. Windows Firewall intercepts most of these events and blocks those events, preventing Personal Firewall from detecting or logging those events. However, Personal Firewall might block additional traffic based upon other security factors, and that traffic will be logged.

Note: Logging is disabled in Windows Firewall by default, but if you choose to enable both firewalls, you can enable Windows Firewall logging. The default Windows Firewall log is C:\Windows\pfirewall.log.

To ensure that your computer is protected by at least one firewall, Windows Firewall is automatically re-enabled when Personal Firewall is uninstalled.

If you disable Personal Firewall or set its security setting to Open without manually enabling Windows Firewall, all firewall protection will be removed except for previously blocked applications.


Using McAfee SecurityCenter

McAfee SecurityCenter is your one-stop security shop. Seamless integration with McAfee SecurityCenter provides a consolidated view of your computer's security status, plus the latest security and virus alerts. You can run SecurityCenter from the McAfee icon in your Windows system tray or from your Windows desktop.

Note: For more information about its features, please click Help in the SecurityCenter dialog box.

While SecurityCenter is running and any of the McAfee products installed on your computer are enabled, a red M icon [image] appears in the Windows system tray (Windows XP notification area).

If one or more of the McAfee applications installed on your computer are disabled, the McAfee icon changes to black: .

To open McAfee SecurityCenter:

  1. Right-click the McAfee icon [image] in the Windows system tray.
  2. Click Open SecurityCenter.

To access a Personal Firewall feature:

  1. Right-click the McAfee icon [image] in the Windows system tray.
  2. Point to Personal Firewall, then click a feature.


Using Personal Firewall

To open Personal Firewall:

  • Right-click the McAfee icon in the Windows system tray, point to Personal Firewall, then select one of the following options:
    • View Summary
    • Internet Applications
    • Inbound Events
    • Options

For more information about each option, see:

  • Understanding the Summary page
  • Understanding the Internet Applications page
  • Understanding the Inbound Events page
  • Configuring Firewall Options


About the Summary page

Understanding the Summary page

The Personal Firewall Summary includes four Summary pages:

  • Main Summary page

  • Application Summary page

  • Event Summary page

  • HackerWatch Summary page

The Summary pages contain a variety of reports on recent inbound events, application status, and world-wide intrusion activity reported by HackerWatch.org. You will also find links to common tasks performed in Personal Firewall.

To open the Personal Firewall Summary pages:

  • Right-click the McAfee icon in the Windows system tray, point to Personal Firewall, then select View Summary. The Main Summary page appears.

To navigate to different Summary pages, click the following:

  • Change View: Open a list of Summary pages. In the list, select a Summary page to view.
  • Right arrow: View the next Summary page.
  • Left arrow: View the previous Summary page.
  • Home: Return to the Main Summary page.


About the Internet Applications page

Understanding the Internet Applications Page

Use the Internet Applications page to view the list of allowed and blocked applications:

  • Right-click the McAfee icon in the Windows system tray, point to Personal Firewall, then select Internet Applications. The Internet Applications page appears.

The Internet Applications page provides the following information:

  • Application names
  • File names
  • Current permission levels
  • Application details: application name and version, company name, application path, application permission level and summary, and application permission creation date.

For more information about working with application rules, see:

  • Creating Internet application rules
  • Changing Internet application rules
  • Deleting Internet application rules


Changing permissions

Creating Internet application rules

You can use the Internet Applications page to change or create application rules. Personal Firewall lets you create, change, and delete an application rule (or permission) for an application that requires Internet access.

To create a new Internet application rule:

  1. Right-click the McAfee icon in the Windows system tray, point to Personal Firewall, then select Internet Applications.
  2. On the Internet Applications page, click one of the following options:
    • New Allowed Application: Allow an application full Internet access.
    • New Blocked Application: Disallow an application Internet access.
  3. In the Select Application to Allow or Select Application to Block dialog, type or browse to the desired application, and then click Open. Depending on your selection, Personal Firewall now blocks or allows the application Internet access.

For information about working with application rules, see:

  • Changing application rules
  • Deleting application rules


Changing permissions

Changing Internet application rules

You can use the Internet Applications page to change or create application rules. Personal Firewall lets you create, change, and delete an application rule (or permission) for an application that requires Internet access.

To change an existing Internet application rule:

  1. Right-click the McAfee icon in the Windows system tray, point to Personal Firewall, then select Internet Applications.
  2. On the Internet Applications list, use either the Change Permission to pane or right-click an entry, to do one of the following:
    • Allow Full Access: Allow an application full Internet access.
    • Outbound Access Only: Allow an application outbound Internet access only.
    • Block This Application: Disallow an application Internet access.
    • Delete Application Rule: Remove the application from the Internet Applications list
    • Get More Information: Review information about the application.

    Note: If a rule exists for an application you attempt to change, Personal Firewall prompts you to reconfigure the rule. Previously blocked applications continue to be blocked when the firewall is set to Open.

For more information about blocked applications, see Why is an application blocked from Internet access when the firewall is set to Open security?

For more information about working with application rules, see:

  • Creating application rules
  • Deleting application rules


Changing permissions

Deleting Internet application rules

Personal Firewall lets you delete an Internet application rule (or permission) for an application.

To delete an application rule:

  1. Right-click the McAfee icon in the Windows system tray, point to Personal Firewall, then select Internet Applications.
  2. In the Application Name list, right-click the application rule, and click Delete Application Rule. The next time the application requests Internet access, the rule will automatically be created.
  3. In the Delete Application Rule dialog, click Yes to delete the rule.

For more information about working with application rules, see:

  • Creating application rules
  • Changing application rules


About the Inbound Events page

Understanding the Inbound Events page

Use the Inbound Events page to view the Inbound Events log, generated when Personal Firewall blocks unsolicited Internet traffic.

To access the Inbound Events page:

  • Right-click the McAfee icon in the Windows system tray, point to Personal Firewall, then select Inbound Events.

Event Information

The Inbound Events page provides the following information:

  • The date and time of the event
  • The source IPs for the Internet connection
  • The hostname for the Internet connection
  • Service or application names
  • Event information, including connection types, connection and destination ports, and explanations of port events. You can view port numbers on the Inbound Events page if you configure this option on the Event Log Settings page.

Note: For more more information about showing port numbers for inbound events, see Configuring Event Log Settings.

Identifying Events

An entry on the Inbound Events page can be green, gray, or red. Each indicates an event type:

  • Green: Connection from a local IP or non-routable IP (e.g. 192.168.X.X). For more information, see About IP Addresses.
  • Gray: Possibly, a spoofed IP addresses, such as the loopback adapter (127.0.0.1) or an invalid IP (0.0.0.0) address.
  • Red: Connection attempt from banned IP address. For more information, see Managing Banned IPs.

For more more information about events, see:

  • Understanding events
  • Showing events in the Inbound Events log
  • Responding to inbound events
  • Managing the Inbound Events log


Understanding events

For more information, see :

  • About IP addresses
  • Events from 0.0.0.0
  • Events from 127.0.0.1
  • Events from computers on your LAN
  • Events from private IP addresses


About IP Addresses

IP addresses are numbers: four numbers each between 0 and 255 to be precise. These numbers identify a specific place that traffic can be directed to on the Internet.

IP address types

There are a number of IP addresses that are unusual for various reasons:

  • Non-Routable IP Addresses: These are also referred to as "Private IP Space." These are IP addresses that cannot be used on the Internet. Private IP blocks are 10.x.x.x, 172.16.x.x - 172.31.x.x, and 192.168.x.x.
  • Loop-Back IP Addresses: Loop-back addresses are used for testing purposes. Traffic sent to this block of IP addresses comes right back to the device generating the packet. It never leaves the device, and is primarily used for hardware and software testing. The Loop-Back IP block is 127.x.x.x.
  • Null IP Address: This is an invalid address. When it is seen, it indicates that the traffic had a blank IP address. This is obviously not normal, and frequently it indicates that the sender is deliberately obscuring the origin of the traffic. The sender will not be able to receive any replies to their traffic unless the packet is received by an application that understands the contents of the packet that will include instructions specific to that application. Any address that starts with 0 (0.x.x.x) is a null address. For example, 0.0.0.0 is a null IP address.


Events from 0.0.0.0

If you see events from IP address 0.0.0.0, there are two likely causes. The first, and most common, is that for some reason your computer received a badly formed packet. The Internet isn't always 100% reliable, and bad packets can occur. Since Personal Firewall sees the packets before TCP/IP can validate them, it might report these packets as an event.

The other situation occurs when the source IP is spoofed, or faked. Spoofed packets may be a sign that someone is scanning around looking for Trojans, and they happened to try your computer. It's important to remember that Personal Firewall blocked this attempt, so your computer is safe.


Events from 127.0.0.1

Events will sometimes list their source IP as 127.0.0.1. It's important to note that this IP is special, and is referred to as the loopback address.

Basically, no matter what computer you're on, 127.0.0.1 always refers to yourself. This address is also referred to as localhost, as the computer name localhost will always resolve back to the IP address 127.0.0.1.

Does this mean that your computer is attempting to hack itself? Is some Trojan or spyware taking over your computer? Not likely. Many legitimate programs use the loopback address for communication between components. For example, many personal mail or Web servers let you configure them via a Web interface that is usually accessible through something like http://localhost/.

However, Personal Firewall allows traffic from these programs, so if you see events from 127.0.0.1, it most likely means that the source IP address is spoofed, or faked. Spoofed packets are usually signs of someone scanning for Trojans. It's important to remember that Personal Firewall blocked this attempt, so your computer is safe. Obviously, reporting events from 127.0.0.1 won't do any good, so there's no need to do so.

That said, some programs, most notably Netscape 6.2 and higher, require you to add 127.0.0.1 to the Trusted IP Addresses list. These programs’ components communicate between each other in such a manner that Personal Firewall cannot determine if the traffic is local or not.

In the example of Netscape 6.2, if you do not trust 127.0.0.1, then you will not be able to use your buddy list. Therefore, if you see traffic from 127.0.0.1 and all of the applications on your computer work normally, then it is safe to block this traffic. However, if a program (like Netscape) is having problems, add 127.0.0.1 in the Trusted IP Addresses list in Personal Firewall, then find out if the problem is resolved.

If placing 127.0.0.1 in the Trusted IP Addresses list fixes the problem, then you need to weigh your options: if you trust 127.0.0.1, your program will work, but you will be more open to spoofed attacks. If you do not trust the address, then your program will not work, but you will remain protected against such malicious traffic.


Events from computers on your LAN

Personal Firewall displays green entries to indicate events that originate from computers on your local area network (LAN).

In most corporate LAN settings, you'll want to select Make all computers on your LAN Trusted in the Trusted IP Addresses options.

However, a local network can invite similar dangers as the Internet, especially if it is on a high-bandwidth public network, which uses DSL or cable modems. In such scenarios, clear the Make all computers on your LAN Trusted option, and then add local IP addresses to the Trusted IP Addresses list.

Note: You can use .255 style addresses to trust an entire block. For example, you can trust your entire ICS (Internet Connection Sharing) network by trusting the IP 192.168.255.255.

For more information about trusting connections, see:

  • Managing Trusted IPs
  • Trusting an address


Events from private IP addresses

IP addresses of the format 192.168.xxx.xxx, 10.xxx.xxx.xxx, and 172.16.0.0 - 172.31.255.255 are referred to as non-routable or private IP addresses. Basically, these IP addresses should never leave your network, and can be trusted most of the time.

The 192.168 block is used with Microsoft Internet Connection Sharing (ICS). If you are using ICS, and see events from this IP block, you might want to add the IP address 192.168.255.255 to your Trusted IP Addresses list. This will trust the entire 192.168.xxx.xxx block.

If you are not on a private network, and see events from these IP ranges, the source IP address may be spoofed, or faked. Spoofed packets are usually a sign that someone is scanning around looking for Trojans. It's important to remember that Personal Firewall blocked this attempt, so your computer is safe.

Since private IP addresses are separate from IP addresses on the Internet, reporting these events will have no effect.


Showing events in the Inbound Events log

The Inbound Events log allows you to display events in a number of ways. The default view limits the view to events occurring on the current day. You can also view events that occurred during the past week, or view the complete log.

Personal Firewall also lets you display events from specific days, specific Internet addresses (IP addresses), or events that contain the same event information.

For information about an event, click the event, and the information appears in the Event Information area at the bottom of the Inbound Events page.

You can use the Inbound Events log to do the following:

  • Show today's events
  • Show this week's events
  • Show the complete log
  • Show a day's events
  • Show events of an Internet address
  • Show events of a single port
  • Show events that share identical event information


Showing today's events

To show today's events:

  1. Right-click the McAfee icon in the Windows system tray, point to Personal Firewall, then select Inbound Events.
  2. On the Inbound Events log, right-click an entry, then click Show Today's Events.


Showing this week's events

To show this week's events:

  1. Right-click the McAfee icon in the Windows system tray, point to Personal Firewall, then select Inbound Events.
  2. On the Inbound Events log, right-click an entry, then click Show This Week's Events.


Showing the complete Inbound Events log

Showing the complete log

To show the complete Inbound Events log:

  1. Right-click the McAfee icon in the Windows system tray, point to Personal Firewall, then select Inbound Events.
  2. On the Inbound Events log, right-click an entry, then click Show Complete Log.

    The Inbound Events log displays all events (except archives) from the Inbound Events log.


Showing a day's events

To show a day's events:

  1. Right-click the McAfee icon in the Windows system tray, point to Personal Firewall, then select Inbound Events.
  2. On the Inbound Events log, right-click an entry, then click Show Only Events From this Day.

    The Inbound Events log displays events for the selected day.


Showing events of an Internet address

This is useful when you need to see other events originating from a particular Internet address. All other events are hidden.

To show events of an Internet address:

  1. Right-click the McAfee icon in the Windows system tray, point to Personal Firewall, then select Inbound Events.
  2. On the Inbound Events log, right-click an entry, then click Show Only Events From Selected Internet Address.

    Events originating from the selected Internet address appear in the Inbound Events log.


Showing events of a single port

Use this option to examine the activity of an individual port. You can review the occurrences of an event on a port, and the sources of the activity. The Event Information column provides a description of the event on the selected port and, if known, the common program or service that uses that port.

To show the events of a single port:

  1. Right-click the McAfee icon in the Windows system tray, point to Personal Firewall, then select Inbound Events.
  2. From the Inbound Events list, right-click an entry, then click Show Only Events on this Port .

Note: Use the Events Logs Settings page to enable the option to show ports.

For more information, see Configuring Event Log Settings.


Showing events that share identical event information

This is useful when you need to see if there are other events in the Inbound Events log that have the same information in the Event Information column as the event you selected. You can find out how many times this event happened, and if it is from the same source. The Event Information column provides a description of the event and, if known, the common program or service that uses that port.

To show events that share identical event information:

  1. Right-click the McAfee icon in the Windows system tray, point to Personal Firewall, then select Inbound Events.
  2. On the Inbound Events log, right-click an entry, then click Show Only Events with the same Event Information.

    Events with the same Event Information appear in the Inbound Events log.


Responding to Inbound Events

In addition to learning about events in the Inbound Events log, you can try to perform a Visual Trace of the IP addresses for an event in the Inbound Events log, or get event details at the anti-hacker online community HackerWatch.org Web site.

For more information, see:

  • Tracing the Selected Event
  • Getting Advice from HackerWatch.org

When you get enough information, you can then decide whether to report the event to HackerWatch.org, or to trust or ban the IP addresses involved in the event.

For more information, see:

  • Reporting an event
  • Trusting an address
  • Banning an address


Tracing the selected event

You can try to perform a Visual Trace of the IP addresses for an event in the Inbound Events log.

To trace a selected event:

  1. Right-click the McAfee icon in the Windows system tray, point to Personal Firewall, then select Inbound Events.
  2. On the Inbound Events log, right-click the event you want to trace, then click Trace Selected Event.

    You can also double-click an event to perform a trace.

    By default, Personal Firewall begins a Visual Trace using the integrated Personal Firewall Visual Trace program.

You can also try to get advice at the anti-hacker online community HackerWatch.org Web site.

When you get enough information, you can then decide whether to report the event to HackerWatch.org, or to trust or ban the IP addresses involved in the event. However, be sure to understand events and IP addresses before taking any action.

Note: You cannot trace looped, private, or invalid IP events.


Getting advice from HackerWatch.org

You can also try to get more information about an event from the anti-hacker online community HackerWatch.org.

To get advice from HackerWatch.org:

  1. Right-click the McAfee icon in the Windows system tray, point to Personal Firewall, then select Inbound Events.
  2. Select the event's entry on the Inbound Events page, then click Get More Information on the I want to pane.

Your default Web browser launches and opens the HackerWatch.org to retrieve information about the event type, and advice about whether to report the event.


Reporting an event

To report an event that you think was an attack on your computer:

  1. Right-click the McAfee icon in the Windows system tray, point to Personal Firewall, then select Inbound Events.
  2. Click the event you want to report, then click Report This Event in the I want to pane.

Personal Firewall reports the event to the HackerWatch.org using your unique ID.


Signing up for HackerWatch.org

When you first open the Personal Firewall Summary page, Personal Firewall contacts HackerWatch.org to generate your unique user ID. If you are an existing user, your sign-up is automatically validated. If you are a new user, you must enter a nickname and email, then click the validation link in the confirmation email from HackerWatch.org to be able to use the event filtering/emailing features at its Web site.

You can report events to HackerWatch.org without validating your user ID. However, to filter and email events to a friend, you must sign up for the service.

Signing up for the service allows your submissions to be tracked and lets us notify you if HackerWatch.org needs more information or further action from you. We also require you to sign up because we must confirm any information we receive for that information to be useful.

All email addresses provided to HackerWatch.org are kept confidential. If a request for additional information is made by an ISP, that request is routed through HackerWatch.org; your email address is never exposed.


Trusting an address

You can use the Inbound Events page to add an IP address to the Trusted IP Addresses list to allow a permanent connection.

If you see an event in the Inbound Events page that contains an IP address that you need to allow, you can have Personal Firewall allow connections from it at all times.

To add an IP address to the Trusted IP Addresses list:

  1. Right-click the McAfee icon in the Windows system tray, point to Personal Firewall, then select Inbound Events.
  2. Right-click the event whose IP address you want trusted, and click Trust the Source IP Address.
  3. Verify that the IP address displayed in the Trust This Address dialog is correct, and click OK. The IP address is added to the Trusted IP Addresses list.

To verify that the IP address was added:

  1. Right-click the McAfee icon in the Windows system tray, point to Personal Firewall, then select Options.
  2. Click the Trusted & Banned IPs icon, then the Trusted IP Addresses tab.

    3. The IP address appears checked in the Trusted IP Addresses list.

For information about trusting a connection's IP address, see Managing Trusted IPs.


Banning an address

Banning an IP address

If an IP address appears in your Inbound Events log, this indicates that traffic from that address was blocked. Therefore, banning an address adds no additional protection unless your computer has ports that are deliberately opened through the System Services feature, or unless your computer has an application that has permission to receive traffic.

Add an IP address to your banned list only if you have one or more ports that are deliberately open and if you have reason to believe that you must block that address from accessing open ports.

If you see an event in the Inbound Events page that contains an IP address that you want to ban, you can have Personal Firewall prevent connections from it at all times.

You can use the Inbound Events page, which lists the IP addresses of all inbound Internet traffic, to ban an IP address that you suspect is the source of suspicious or undesirable Internet activity.

To add an IP address to the Banned IP Addresses list:

  1. Right-click the McAfee icon in the Windows system tray, point to Personal Firewall, then select Inbound Events .
  2. The Inbound Events page lists the IP addresses of all inbound Internet traffic. Select an IP address, and then do one of the following:
    • Right-click the IP address, then select Ban the Source IP Address.
    • From the I want to menu, click Ban This Address.
  3. In the Add Banned IP Address Rule dialog, use one or more of the following settings to configure the Banned IP Address rule:
    • A Single IP Address: The IP address to ban. The default entry is the IP address that you selected from the Inbound Event page.
    • An IP Address Range: The IP addresses between the address you specify in From IP Address and the IP address you specify in To IP Address.
    • Make this rule expire on: Date and time in which the Banned IP Address rule expires. Select the appropriate drop down menus to select the date and the time.
    • Description: Optionally describe the new rule.
  4. Click OK.
  5. In the dialog box, click Yes to confirm your setting. Click No to return to the Add Banned IP Address Rule dialog.

If Personal Firewall detects an event from a banned IP address, it will alert you according to the method you specified on the Alert Settings page.

To verify that the IP address was added:

  1. Click the Options tab.
  2. Click the Trusted & Banned IPs icon, then click the Banned IP Addresses tab.

    3. The IP address appears checked in the Banned IP Addresses list.

For more information, see Managing Banned IPs


Managing the Inbound Events log

You can use the Inbound Events page to manage the events in the Inbound Events log, generated when Personal Firewall blocks unsolicited Internet traffic.

For more information about logging, see:

  • Archiving the Inbound Events log
  • Viewing an archived Inbound Events log
  • Deleting the selected event
  • Clearing the Inbound Events log
  • Exporting displayed events
  • Copying an event to the Clipboard


Archiving the Inbound Events log

You can archive the current Inbound Events log to save all of the logged inbound events, including their date and times, source IPs, hostnames, ports, and event information. You should archive your Inbound Events log periodically to prevent the Inbound Events log from growing too large.

To archive the Inbound Events log:

  1. Right-click the McAfee icon in the Windows system tray, point to Personal Firewall, then select Inbound Events.
  2. On the Inbound Events page, click Archive.
  3. On the Archive Log dialog, click Yes to proceed with the operation.
  4. Click Save to save the archive in the default location, or browse to a location where you want to save the archive.

Note: By default, Personal Firewall automatically archives the Inbound Events log. Check or clear Automatically archive logged events in the Event Log Settings page to enable or disable the option.

For more information about archives, see Viewing an archived Inbound Events log.


Viewing an archived Inbound Events log

You can view any Inbound Events log that you previously archived. The saved archive includes date and times, source IPs, hostnames, ports, and event information for the events.

To view an archived Inbound Events log:

  1. Right-click the McAfee icon in the Windows system tray, point to Personal Firewall, then select Inbound Events.
  2. On the Inbound Events page, click View Archives.
  3. Select or browse for the archive file name and click Open.

For more information about archives, see Archiving the Inbound Events log.


Deleting the selected event

To delete events from the Inbound Events log:

  1. Right-click the McAfee icon in the Windows system tray, point to Personal Firewall, then select Inbound Events.
  2. Click the event's entry on the Inbound Events page that you want to delete.
  3. On the Edit menu, click Delete Selected Event. The event is deleted from the Inbound Events log.


Clearing the Inbound Events log

You can clear all information from the Inbound Events log.

Warning: Once you clear the Inbound Events log, you cannot recover it. If you think you will need the Events Log in the future, you should archive it instead.

To clear the Inbound Events log:

  1. Right-click the McAfee icon in the Windows system tray, point to Personal Firewall, then select Inbound Events.
  2. On the Inbound Events page, click Clear Log.
  3. Click Yes in the dialog to clear the log.


Exporting displayed events

You can export your Inbound Events log to a text file if you need to share it with your ISP, technical support, or law enforcement officials.

  1. Right-click the McAfee icon in the Windows system tray, point to Personal Firewall, then select Inbound Events.
  2. On the Inbound Events page , click Export Displayed Events.
  3. Browse to the location to which you want to save the events.
  4. Rename the file if necessary, then click Save.

    Your events are saved to a .txt file in the location you chose.


Copying an event to the Clipboard

You can copy an event to the clipboard so that you can paste it in a text file using Notepad.

To copy events to the clipboard:

  1. Right-click the McAfee icon in the Windows system tray, point to Personal Firewall, then select Inbound Events.
  2. Click the event in the Inbound Events log that you need to export.
  3. On the Edit menu, click Copy Selected Event to Clipboard.
  4. Open Notepad:
    • Type notepad on the command line or click the Windows Start button, point to Programs, then Accessories. Select Notepad.
  5. Click Edit, then click Paste. The event appears in Notepad. Repeat this step until you have all of the necessary events.
  6. Save the Notepad file in a safe place.


About alerts

Understanding security alerts

We recommend that you become familiar with the types of alerts you will encounter while using Personal Firewall. Review the following types of alerts that can appear and the possible responses you can choose, so that you can confidently respond to an alert.

Recommendations that appear on alerts help you decide how to handle the event that prompted the alert.

To configure Personal Firewall to produce alerts:

  1. Right-click the McAfee icon in the Windows system tray, point to Personal Firewall, then select Options.
  2. Click the Alert Settings icon.
  3. From the Alert to Display drop-down on the Alert Settings page, select one of the following:
    • Show Only Red Alerts
    • Show Only Red and Green Alerts
    • Show All Alert

Alert Types

Personal Firewall provides three types of alerts:

  • Red Alert: Contains important information that requires your immediate attention.
  • Green Alert: Informs you of changes that have been made to Personal Firewall.
  • Blue Alert: Contains information, which does not require a response.


About alerts

Red Alerts

Red Alerts contain important information that requires your immediate attention. Red Alerts are as follows:

  • Internet Application Blocked: This alert appears if Personal Firewall blocks an application from accessing the Internet.
  • Application Wants to Access the Internet: This alert appears when Personal Firewall detects Internet or network traffic for new applications.
  • Application Has Been Modified: This alert appears when Personal Firewall detects that an application you have previously allowed to access the Internet has changed. If you have not recently upgraded the application, you should be careful about granting the modified application access to the Internet.
  • Application Requests Server Access: This alert appears when Personal Firewall detects that an application you have previously allowed to access the Internet has requested Internet access as a server.

Note: The Windows XP SP2 default Automatic Updates setting downloads and installs updates for the Windows OS and other Microsoft programs running on your computer without messaging you. When an application has been modified from one of Windows silent updates, Personal Firewall alerts appear the next time the Microsoft application is run.

Important: You must grant access to applications that require Internet access for online product updates.


About alerts

Green Alerts

Green Alerts inform you of changes that have been made to Personal Firewall. For example, Green Alerts can inform you of applications to which Personal Firewall has automatically granted Internet Access, or inform you of any new application rules. To produce Green Alerts, Smart Recommendations, and Show All Alerts or Show Only Red and Green Alerts, must be set. Green Alerts will not appear when Personal Firewall is set to Open security.

  • Program Allowed to Access the Internet: This alert appears when Personal Firewall automatically grants Internet access for all new or modified applications, then notifies you.
  • Application Has Been Modified: This alert appears when Personal Firewall detects that an application has been replaced with an application that HackerWatch.org allows.


About alerts

Blue Alerts

Blue Alerts contain information, which does not require a response. To generate Blue Alerts, Show All Alerts must be set. Blue Alerts will not appear when Personal Firewall is set to Open security or in Lockdown.

  • Connection Attempt Blocked: This alert appears when Personal Firewall blocks unwanted Internet or network traffic.

If the IP address originates from a DHCP or DNS server, the Ban this IP Address option does not appear in the alert. If the address is not DHCP or DNS-based, the the Blue Alert displays the Ban this IP Address option.


About alerts

Help me choose a Red Alert option

Personal Firewall protects your computer by allowing Internet access to trusted applications only. Typically, Personal Firewall automatically grants or denies an application Internet access.

When Personal Firewall does not recognize an application, a Red Alert prompts you to grant or block different types of Internet connection requests. Different Internet behavior on your computer prompts different Red Alert types and options.

If you are uncertain which option to select, consider the following Red Alerts, and the scenarios that prompt them.

Application Wants to Access the Internet alert

The Application Wants to Access the Internet alert appears when Personal Firewall detects Internet or network traffic from a new application.

Alert Options

The Application Wants to Access the Internet alert provides the following options:

  • Grant Access: Permanently allow the application a full Internet connection.
  • Grant Access Once: Temporarily allow the application an Internet connection. When the application quits, Internet access is revoked.
  • Grant Outbound Access: Allow the application an outbound Internet connection (Tight security).
  • Block All Access: Permanently disallow the application an Internet connection.
  • Help Me Choose: View Online Help for assistance in selecting an option.

Alert Scenarios

The following lists scenarios that can prompt the Application Wants to Access Internet alert:

  • An application attempts to check for automatic updates.
  • An application attempts to download information, such as email, news, or music.
  • An application attempts to connect to a licensing server to verify your right to use an application.
  • An application uses another application, for example, IEXPLORE.EXE, RUNDLL32.EXE, or svchost.exe, to access the Internet.
  • A peer-to-peer file sharing application attempts to establish communication with another computer over the Internet.

Application Requests Server Access alert

The Application Requests Server Access alert appears when Personal Firewall detects an application which requests Internet access as a server.

Alert Options

The Application Requests Server Access alert provides the following options:

  • Grant Server Access: Permanently allow the application an Internet connection.
  • Grant Access Once: Temporarily allow the application an Internet connection. When the application quits, Internet access is revoked.
  • Restrict to Outbound Access: Allow the application an outgoing Internet connection only.
  • Block All Access: Permanently disallow the application an Internet connection.
  • Help Me Choose: View Online Help for assistance in selecting an option.

Alert Scenarios

The following lists scenarios that can prompt the Application Requests Server Access alert:

  • A Web Server requests permission to listen to inbound Internet requests.
  • An FTP Server requests permission to listen to inbound Internet requests.

Application Has Been Modified alert

The Application Has Been Modified alert appears when Personal Firewall detects a previously trusted or blocked, but changed, application, that requests Internet access.

Alert Options

The Application Has Been Modified alert provides the following options:

  • Grant Access: Permanently allow the application an Internet connection. If you are running Tight security, Grant Outbound Access appears instead.
  • Grant Access Once: Temporarily allow the application an Internet connection. When the application quits, Internet access is revoked.
  • Block All Access: Permanently disallow the application an Internet connection.
  • Help Me Choose: View Online Help for assistance in selecting an option.

Alert Scenarios

The following is a scenario that can prompt the Application Has Been Modified alert:

  • After an application is upgraded, it attempts to access the Internet.
  • An application, modified by a virus, attempts to access the Internet.

For more information about alerts, see:

  • Understanding security alerts
  • Configuring Alert Settings
  • Application Wants to Access the Internet alert
  • Application Requests Server Access alert
  • Application Has Been Modified alert


Internet Application Blocked alert

This alert appears when Personal Firewall automatically denies an application access to the Internet.

To select an access level:

  • Select one of the following options:
    • Find Out More Information: Review details about the event on the Inbound Events log

    For more information about the Inbound Events log, see About Inbound Events.

    • Launch McAfee VirusScan: Scan your computer for viruses. If you do not have VirusScan installed, then Personal Firewall prompts you to launch McAfee VirusScan Online.
    • Continue What I Was Doing - Take no action beyond what Personal Firewall has already done.


Application Wants to Access the Internet alert

If you select Standard or Tight security in the Security Settings options, Personal Firewall displays an alert when it detects Internet or network traffic for new application. In Lockdown, the alert appears also.

If an alert appears, which recommends caution before allowing the application Internet access, you can click Click here to learn more for more information about the application. This option appears on the alert only if Personal Firewall is configured to use Smart Recommendations.

When Personal Firewall does not recognize the application attempting an Internet connection, an alert does not provide a recommendation. However, you can click Help me Choose for Help. Alternatively, you can report the application to McAfee by clicking Tell McAfee about this program. This launches your Web browser, and opens HackerWatch.org, where you can enter information about the application.

The information you submit is used in conjunction with other research tools to determine whether an application should be listed in our known applications database, and if so, how it should be treated by Personal Firewall.

To select an access level:

  • Click one of the following options:
    • Grant Access: Permanently allow the application a full Internet connection. Running Tight security displays Grant Outbound Access instead.
    • Grant Access Once: Temporarily allow the application an Internet connection. When the application quits, Internet access is revoked.
    • Block All Access: Permanently disallow the application an Internet connection.
    • Help Me Choose: View Online Help for assistance in selecting an option


Application Has Been Modified alert

If you selected Trusting, Standard, or Tight security on the Security Settings page, Personal Firewall displays an alert when Personal Firewall detects that an application, previously allowed to access the Internet, has changed. If you have not recently upgraded the application, be careful about granting the modified application access to the Internet.

To select an access level:

  • Click one of the following options:
    • Grant Access: Allow an application a full Internet connection.
    • Grant Access Once:Temporarily allow the application an Internet connection (Tight security). When the application quits, Internet access is revoked.
    • Block All Access: Permanently disallow the application an Internet connection.
    • Help Me Choose: View Online Help for assistance in selecting an option.


Application Requests Server Access alert

If you selected Tight security in the Security Settings options, Personal Firewall displays an alert when it detects that an application you have previously allowed to access the Internet has requested Internet access as a server.

To select an access type:

  • Click one of the following options:
    • Grant Server Access: Trust an application to handle incoming and outgoing data.
    • Grant Access Once:Temporarily trust the application to handle incoming and outgoing data. When the application quits, Internet access is revoked.
    • Restrict to Outbound Access: Trust an application to pass outgoing data only.
    • Block All Access: Permanently block the application from all Internet activity. After you select Block All Access, click Yes to confirm your choice. Click No to return to the Red Alert.
    • Help Me Choose: View Online Help for assistance in selecting an option.


Program Allowed to Access the Internet alert

If you select Trusting security in the Security Settings options and enabled Green Alerts, Personal Firewall automatically grants Internet access for all new applications, and notifies you of the event with an alert.

To select an access level:

  • Select one of the following options:
    • View the Application Log: Review details about the event on the Personal Firewall Internet Applications Log.
    • Turn Off This Alert Type: Prevent the selected alert type from appearing.
    • Continue What I Was Doing: Allow Personal Firewall to continue if you do not want to take action beyond what Personal Firewall has already done.
    • Block All Access: Prohibits Internet access. To select this option, expand the alert.


Connection Attempt Blocked alert

If you selected Display all Alerts and Trusting, Standard, or Tight security, Personal Firewall displays an alert message when it blocks unwanted Internet or network traffic.

View a brief description of the event, then choose from the following options:

  • View the Event Log: Review information about the event on the Inbound Events log.

For more information about the Inbound Events log, see About Inbound Events.

  • Trace This Address: Perform a Visual Trace of the event's IP address.
  • Ban This Address: Block the Internet connection, and add the IP address to the Banned IP Addresses list. This option appears when you expand the alert.

For more information about banning IP addresses, see Managing Banned IPs.

  • Trust This Address: Allow the IP address to connect to your computer. This option appears when you expand the alert.

For more information about trusting an IP address, see Managing Trusted IPs.

  • Continue What I Was Doing if you do not want to take action beyond what Personal Firewall has already done.


Configuring Your Firewall Options

Configuring Firewall Options

After you install Personal Firewall, the firewall automatically protects your computer. Typically, it is unnecessary to reconfigure Personal Firewall settings since the default settings provide adequate safety against intrusion. You can, however, modify the settings to suit your personal needs by using various resources on the Options page.

To open the Options page, right-click the McAfee icon in the Windows system tray, point to Personal Firewall, then select Options.

You can use the following options to configure your Personal Firewall installation:

  • Running Setup Assistant: Use the Setup Assistant to help you configure your settings for Personal Firewall.
  • Configuring Alert Settings: Configure alert levels and behavior, and Smart Recommendations for handling new applications that request Internet access.
  • Configuring Security Settings: Configure security levels (such as Tight and Standard) and Intrusion Detection Events (IDS) for handling advanced security threats.
  • Restoring default settings: Reset Personal Firewall default settings.
  • Configuring Event Log Settings: Configure inbound logging preferences.
  • Trusted & Banned IPs: Add, edit, and remove trusted and banned IP addresses.
    • Managing Trusted IPs
    • Managing Banned IPs
  • Enabling or disabling Lockdown: Instantly block all incoming and outgoing network traffic between your computer and the Internet.
  • Managing System Services: Open system ports for various services and applications, such as Web servers, file sharing, and games.
  • Viewing the Traffic Monitor: View recent traffic and active applications on your Internet connection.

For more information about updates, see Updating Personal Firewall .


Running Setup Assistant

You can use the Setup Assistant to configure your settings during installation of Personal Firewall or when you want to modify your existing settings.

To configure your settings using the Setup Assistant:

  1. Right-click the McAfee icon in the Windows system tray, point to Personal Firewall, then select Options.
  2. Click Run Setup Assistant.
  3. Follow the instructions which appear in the series of dialog boxes:
  • Scan My Computer: Scan your computer for viruses. If McAfee VirusScan is not installed on your computer, ensure you are connected to the Internet, and click Use McAfee FreeScan. McAfee Freescan is an online virus scanner. When the scan is done, click Continue. If you do not want to run scan your computer for viruses, click Skip This Step.
  • Choose Your Personal Alert Level: Select the type of alerts to receive. Select from the following Alert types:
    • Only Show Red Alerts: Displays critical information about current Internet activity, which requires your immediate attention.
    • Show Green and Red Alerts: Shows Red and Green Alerts which display information about actions automatically taken.
    • Show All Alerts: Displays information which does not require a response.

    • For more information about alerts, see About security alerts.

  • Choose Your Network Type: To optimize your Personal Firewall settings, select the type of Internet connection you use:
    • Dial-Up Internet Access: A modem with a data transfer rate of 56 Kbps and below, and that is not always connected to the Internet.
    • Always-On Connection: Cable and DSL broadband connections.
    • Home Network: A NAT/Router between a broadband connection and multiple home computers and devices.
    • Office Network: An environment which can include other firewalls, proxy servers, and NATs.
  • Choose Your Network Access: Select how other computers on your network access your computer:
    • Do Not Trust My Local Network: Select if you are not connected to a home or office network that you trust.
    • Completely Trust My Local Network: Select to allow other computers on your network to access your computer.
    • Manage Each Network Separately: Select to manage individual networks separately, if you computer is on multiple networks.
  4. For an overview about Personal Firewall, you can click User Tutorial. Ensure that your computer is connected the the Internet.

When you are finished running Setup Assistant, click Finish.


Alert Settings

Configuring Alert Settings

You can configure the behavior of alerts when Personal Firewall detects intrusion attempts and undesirable Internet activity. By default, only Red Alerts appear when outbound events occur. You can change which alert types appear.

For more information about alerts, see About Alerts.

To configure alert settings:

  1. Right-click the McAfee system tray icon, point to Personal Firewall, then select Options.
  2. Click Alert Settings.
  3. Select the type of alert to display:
    • Show Only Red Alerts: Personal Firewall shows you Red Alerts only. Red Alerts contain important information that requires your immediate attention. For example, an application requests access to the Internet and you must grant or block access.
    • Show Only Red and Green Alerts: Personal Firewall generates Red and Green Alerts when Smart Recommendations is enabled. Green Alerts describe changes to Personal Firewall settings, such as new application rules or applications which have been automatically granted Internet access.
    • Show All Alerts: Personal Firewall shows you Red, Green, and Blue Alerts. Blue Alerts contain information which do not require a response. If the IP address originates from a DHCP or DNS server, the Ban this IP Address option does not appear in the alert. If the address is not DHCP or DNS-based, the the Blue Alert displays the Ban this IP Address option.
  4. Select additional response options for displayed alerts:
    • Flash the tray icon when alerts aren’t displayed: Flash the system tray icon when an inbound event occurs and Personal Firewall application is closed (but not shutdown).
    • Auto-hide non-critical alerts after 10 seconds: Hide an alert ten seconds after it alerts you about an event. The action that Personal Firewall takes in response to the alert is the default action. If you deselect this checkbox, alerts remain on your screen until you choose a course of action.
    • Animate slide-in alerts: Activate the slide-in alert feature on your Windows desktop. Otherwise, clear the checkbox to receive standard popup alerts.
    • Enable Gaming Mode: Hide alerts during full-screen gameplay. If Personal Firewall detects intrusion attempts or suspicious activity during gameplay, Red Alerts appear after you exit the game. The option is disabled by default.
  5. Select whether Personal Firewall uses or displays recommendations on alerts:
    • Use Smart Recommendations: When Personal Firewall detects new applications, it automatically allows or blocks applications based on a database of recognized applications. You will always be alerted of unrecognized or potentially dangerous programs.
    • Display Smart Recommendations Only: Whenever a new application requests Internet access, you must decide whether to allow or block the application. Personal Firewall does not automatically allow or block the application, but does recommend a course of action.
    • Do not use Smart Recommendations: Whenever a new application requests Internet access, you must decide whether to allow or block the application. Personal Firewall does not automatically allow or block the application and does not recommend a course of action.
  6. Click OK when you are finished.


Security Settings

Configuring Security Settings

You can configure security options to indicate how Personal Firewall responds when it detects unwanted traffic. By default, the Standard security level is enabled.

If you are an experienced firewall user, you can use other settings. In Standard security level, when you grant an application access, the access is unrestricted or Full Access. Full Access allows the application to create outbound connections and listen for unsolicited incoming connections.

To configure security settings:

  1. Right-click the McAfee icon in the Windows system tray, point to Personal Firewall, then select Options.
  2. Click Security Settings.
  3. Set the security level by moving the slider to the desired level.

    4. You can accept the default Standard setting, or select levels between Lockdown and Open:

    • Lockdown: All traffic is stopped. This is comparable to unplugging your Internet connection. You can use this setting to block ports you configured to be open in the System Services page. During Lockdown, alerts can continue to prompt you to block applications.

    For more information about Lockdown, see Enabling or disabling Lockdown.

    • Tight: An application requests only the type of access to the Internet that it explicitly needs (for example, Outbound Only Access), and you either grant access or block it. Later, if the application requests Full Access, you can either grant Full Access or keep it limited to Outbound Only Access. Use this setting if you are an experienced firewall user.
    • Standard (recommended): An application granted Internet access receives Full Access. Full Access allows the application to create outbound connections and listen for unsolicited incoming connections.
    • Trusting: All applications are automatically trusted when they first attempt to access the Internet. However, you can configure Personal Firewall to generate alerts that notify you about new applications on your computer. Use this setting when games or streaming media fail.
    • Open: All Internet traffic passes through Personal Firewall without filtering.

      Note: Previously blocked applications continue to be blocked when the firewall is set to the Open security setting. For more information, see Why is an application blocked from Internet access when the firewall is set to Open security?

  4. Select additional security settings:
    • Record Intrusion Detection (IDS) Events in Inbound Events Log: If you select this option, events detected by IDS will appear in the Inbound Events log. The Intrusion Detection System detects common attack types and other suspicious activity. Intrusion detection monitors every inbound data packet for suspicious data transfers or transfer methods. It compares these to a "signature" database, automatically drops the packets from the offending computer, and logs the event.

      IDS looks for specific traffic patterns used by attackers. IDS checks each packet that your machine receives to detect suspicious or known-attack traffic. For example, if Personal Firewall sees ICMP packets, it analyzes these for suspicious traffic patterns by comparing the ICMP traffic against known attack patterns.
    • Accept ICMP ping requests: ICMP traffic is used mainly for performing traces and pings. Pinging is frequently used to perform a quick test before attempting to initiate communications. If you are using or have used a peer-to-peer file-sharing program, you might find yourself being pinged a lot. If you select this option, Personal Firewall allows all ping requests without logging the pings in the Inbound Events log. If you do not select this option, Personal Firewall blocks all ping requests and logs the pings in the Inbound Events log.
    • Allow restricted users to change Personal Firewall settings: Allow restricted users to modify Personal Firewall settings (Windows 2000 Professional and Windows XP only).
  5. Click OK if you are finished making changes.


Security Settings

Restoring default settings

Run Reset Options to automatically reset the default settings for Personal Firewall. If Personal Firewall exhibits undesirable behavior that you are unable to easily correct, you can undo your existing settings and revert to the product’s original default settings, which provide a stable and working version of Personal Firewall.

Restore your default settings

When you reset Personal Firewall to its default settings, your existing settings will be lost and you will be unable to recover them.

Restoring default settings removes all custom settings, for example:

  • Alert levels, HackerWatch.org and Smart Recommendations
  • Banned and trusted IP rules
  • Security levels
  • Application rules
  • System services
  • Event log settings

To restore Personal Firewall's default settings:

  1. In Personal Firewall, click the Options tab.
  2. On the Options page, click Reset Options.
  3. Click Yes in the dialog box to confirm that you want to reset all configured settings. Click No to return to the Options page.

After you click Yes, your settings are reset to Personal Firewall's original settings.


Event Log Settings

Configuring Event Log Settings

You can configure the Personal Firewall to log inbound connections.

To configure event log settings:

  1. Right-click the McAfee icon in the Windows system tray, point to Personal Firewall, then select Options.
  2. Click Event Log Settings.
  3. On the Inbound Events Logging Settings page, select one of the following options:
    • Log the Event
    • Do Not Log The Event
  4. After selecting to log events, click Configure to specify which event types to log.
  5. In the Configure Events to Log dialog, select from the following options:
    • Log ICMP Pings
    • Log Traffic from Banned IP Addresses
    • Log Events on System Services Ports
    • Log Events on Unknown Ports
    • Do not log events on the following ports
  6. Click OK to save your settings.
  7. Select Show port numbers in inbound events view to display ports associated with logged events.

For more information about viewing ports on the Inbound Events page, see Show port numbers in log view.

  8. Click OK if you are finished making changes.


Trusted IPs

Managing Trusted IPs

The Trusted IP Addresses list lets you allow all traffic from a specific computer to reach your computer. Personal Firewall does not log traffic or generate event alerts from IP addresses in the Trusted IP Addresses list.

Personal Firewall trusts any IP addresses in the list that has a check mark next to it, and always allows traffic from those IPs through the firewall on any port. Personal Firewall does not log any events from trusted IP addresses. For trusted IPs, your computer will behave as if there is no firewall.

Make certain that you only trust computers that are safe. If a computer that you trust is infected through a worm or other mechanism, you might be vulnerable to it. Always make a best effort to ensure that computers you trust are also protected by a firewall and an up-to-date anti-virus package. Also, be sure that you keep your own anti-virus software up to date.

To add an IP address to the Trusted IP Addresses list:

  1. Right-click the McAfee icon in the Windows system tray, point to Personal Firewall, then select Options.
  2. Click the Trusted & Banned IPs icon.
  3. Click the Trusted IP Addresses tab.
  4. Click Add.
  5. In the Add Trusted IP Address Rule window, configure the new rule using the following options:
    • A Single IP Address: The IP address to trust. The default entry is the IP address that you selected on the Trusted IP Addresses page.
    • An IP Address Range: The IP addresses between the address you specify in From IP Address and the IP address you specify in To IP Address.
    • Make this rule expire on: Date and time in which the Banned IP Address rule expires. Select the drop-downs to select the date and time (optional).
    • Description: Describe the Trusted IP Address rule (optional).
  6. Click OK. The IP address appears checked in the Trusted IP Addresses list.

  7. Click OK if you are finished making changes.

Note: If you are using your computer on an office LAN, and you have no reason to block traffic from other computers on that LAN, you can instruct Personal Firewall to trust all computers on the LAN by selecting My Local Area Network (LAN) located in the Trusted IP Addresses list.

If you are using a home network without a hardware firewall, if you select My Local Area Network (LAN), you will open your computer to everyone on the subnet. If you want to add a computer that is on the home network and is not behind a hardware firewall, you should manually add the IP address of that machine to the Trusted IP Addresses list.

To edit an IP address on the Trusted IP Addresses list:

  1. Right-click the McAfee icon in the Windows system tray, point to Personal Firewall, then select Options.
  2. Click the Trusted & Banned IPs icon.
  3. Click the Trusted IP Addresses tab.
  4. Select an address to edit, then click Edit.
  5. In the Edit Trusted IP Address Rule window, reconfigure the rule using the following options:
    • A Single IP Address: The IP address to trust. The default entry is the IP address that you selected on the Banned IP Addresses page.
    • An IP Address Range: The IP addresses between the address you specify in From IP Address and the IP address you specify in To IP Address.
    • Make this rule expire on: Date and time in which the Trusted IP Address rule expires. Select the drop-downs to select the date and time (optional).
    • Description: Describe the Trusted IP Address rule (optional).
  6. Click OK if you are finished making changes.

To remove an IP address from the Trusted IP Addresses list:

  1. Right-click the McAfee icon in the Windows system tray, point to Personal Firewall, then select Options.
  2. Click the Trusted & Banned IPs icon.
  3. Click the Trusted IP Addresses tab.
  4. Do one of the following:
    • Clear the checkbox next to the IP Address to disable the entry but retain the IP address.
    • Select the IP address, then click Remove. In the Delete Selected Rule dialog, click Yes to proceed with the removal.
  5. Click OK if you are finished making changes.

If you are using your computer on an office LAN, and you have no reason to block traffic from other computers on that LAN, you can instruct Personal Firewall to trust all computers on the LAN.

To trust all computers on your office network:

  1. Right-click the McAfee icon in the Windows system tray, point to Personal Firewall, then select Options.
  2. Click the Trusted & Banned IPs icon.
  3. Click the Trusted IP Addresses tab.
  4. Select My Local Area Network (LAN).
  5. Click OK if you are finished making changes.


Banned IPs

Managing Banned IPs

The Banned IP Addresses list gives you a convenient mechanism to block an internet connection from a specific computer. If Personal Firewall detects an event from a banned computer, the firewall might alert you if you chose to receive these types of alerts.

For more information about alert settings, see Configuring Alert Settings.

Normally, it is not necessary to ban IPs: Personal Firewall blocks all unwanted traffic. You should ban an IP only when you are certain an Internet connection poses a specific threat. Ensure that you do not block important IP addresses, such as your DNS or DHCP server, or other servers at your ISP.

To add an IP address to the Banned IP Addresses list:

  1. Right-click the McAfee icon in the Windows system tray, point to P ersonal Firewall, then select Options.
  2. Click Trusted & Banned IPs.
  3. Click the Banned IP Addresses tab.
  4. Click Add.

Note: You cannot add an IP address that appears in the Trusted IP Addresses list.

  5. In the Add Banned IP Address Rule dialog, configure your Banned IP Address rule using one or more of the following settings:
    • A Single IP Address: The IP address to ban.
    • An IP Address Range: The IP addresses between the address you specify in From IP Address and the IP address you specify in To IP Address.
    • Make this rule expire on: Date and time the Banned IP Address rule expires. Select the drop-downs to select the date and time (optional).
    • Description: Describe the Banned IP Address rule (optional).
  6. Click OK.
  7. In the McAfee Personal Firewall Plus dialog, click Yes to confirm your setting. Click No to return to the Add Banned IP Address Rule dialog.

If you configured Personal Firewall to display all alerts, you will be alerted if it detects an event from a Banned IP Addresses list.

For more information about banning computers and IP addresses, see Banning an IP address.

Edit a banned IP address

Personal Firewall lets you quickly edit banned IP addresses from the McAfee system tray icon.

To edit an IP address on the Banned IP Addresses list:

  1. Right-click the McAfee icon in the Windows system tray, point to Personal Firewall, then select Options.
  2. Click Trusted & Banned IPs.
  3. Click the Banned IP Addresses tab.
  4. Select an address to edit, then click Edit.
  5. In the Edit Banned IP Address Rule dialog, modify your Banned IP Address rule using one or more of the following settings:
    • A Single IP Address: The IP address that you originally banned.
    • An IP Address Range: The IP addresses between the address you specified in From IP Address and the IP address you specify in To IP Address.
    • Make this rule expire on: Date and time you configured the Banned IP Address rule to expire. Select the appropriate drop-down to change the date and time.
    • Description: Optionally describe the Banned IP Address rule.
  6. Click OK.
  7. In the McAfee Personal Firewall Plus dialog, click Yes to confirm your setting. Click No to return to the Edit Banned IP Address Rule window.

Remove a banned IP address

If you decide that an Internet connection is not the source of suspicious or undesirable Internet activity, you can use the Banned IP Addresses page to remove the ban on the IP address

To remove an IP address from the Banned IP Addresses list:

  1. Right-click the McAfee icon in the Windows system tray, point to Personal Firewall, then select Options.
  2. Click Trusted & Banned IPs.
  3. Click the Banned IP Addresses tab.
  4. Do one of the following:
    • Clear the IP Address. The list retains the entry, but the IP address for the Internet connection is no longer banned.
    • Select the IP address, then click Remove. In the Delete Selected Rule? dialog, click Yes to proceed with the removal.
  5. Click OK.

For more information about banning and trusting computers, see Banning an IP address.


Security Settings

Enabling or disabling Lockdown

Running the Lockdown feature in Personal Firewall allows you to instantly block all incoming and outgoing network traffic between your computer and the Internet. Lockdown is beneficial when handling computer-related emergencies, for users who need to block all traffic to isolate and troubleshoot a problem on their computer, or for those who are uncertain, and need to determine, how to manage a program's access to the Internet.

Enable and disable Lockdown

You can enable and disable Lockdown from three locations in Personal Firewall:

  • The McAfee icon in the Windows system tray
  • McAfee SecurityCenter
  • Any Personal Firewall page

To enable Lockdown from the Mcafee icon in the Windows system tray:

  • Right-click the McAfee icon in the Windows system tray, point to Personal Firewall, then select Lockdown Computer.

To disable Lockdown from the Mcafee icon in the Windows system tray:

  • Right-click the McAfee icon in the Windows system tray, point to Personal Firewall, then select Unlock Computer.

To enable or disable Lockdown from Mcafee SecurityCenter:

  1. From McAfee SecurityCenter, click the Personal Firewall Plus tab.
  2. Click Lockdown My Computer from the I want to menu. To return to your previous security level, click Unlock My Computer.

To enable or disable Lockdown from any Personal Firewall page:

  • Click Lockdown from the upper bar in any page in Personal Firewall. To return to your previous security level, click Unlock in the upper bar.

Note: During Lockdown, application-related alerts continue to appear.


System Services

Managing System Services

For certain applications, including Web servers and file-sharing server programs, to work correctly, they must accept unsolicited connections from other computers through designated system service ports.

From the System Services page, you can do the following:

  • Allow applications to act as servers on the Internet or LAN.
  • Add or edit a port for an application.
  • Disable or remove a port for an application.

The following are examples of applications which typically require ports to be opened from the System Services list:

  • Mail server: You do not need to open a Mail Server port to receive email. You only need to open a port if the computer protected by Personal Firewall acts as an email server.
  • Web server: You do not need to open a Web Server port to run a Web browser. You only need to open a port if the computer protected by Personal Firewall acts as a Web server.

Note: An opened system service port that does not have an application running on it poses no security threat. For example, if you perform a firewall test scan on your Web server port (usually, port 80), but the Web server is not running, the scan will report that the port is closed.

Warning: Only select a port in the System Services list if you are certain it must be open. You will rarely need to open a port.

Typical Application Ports

The following is a list of service ports that your operating system or other system applications might attempt to open. Because these ports represent the most likely source of insecurities in your system, they must be explicitly allowed in this list to enable access by outside computers. To allow your system to expose these ports to the outside world, make sure the checkbox next to the port description is selected.

System Services

This list shows the standard ports for certain applications.

  • File Transfer Protocol (FTP) Ports 20-21
  • Mail Server (IMAP) Port 143
  • Mail Server (POP3) Port 110
  • Mail Server (SMTP) Port 25
  • Microsoft Directory Server (MSFT DS) Port 445
  • Microsoft SQL Server (MSFT SQL) Port 1433
  • Remote Assistance / Terminal Server (RDP) Port 3389
  • Remote Procedure Calls (RPC) Port 135
  • Secure Web Server (HTTPS) Port 443
  • Universal Plug and Play (UPNP) Port 5000
  • Web Server (HTTP) Port 80
  • Windows File Sharing (NETBIOS) Ports 137-139

Configuring ports for applications

To allow applications to act as servers on the Internet or LAN:

  1. Right-click the McAfee icon in the Windows system tray, point to Personal Firewall, then select Options.
  2. Click the System Services icon.
  3. Select the checkbox next to the applications you want to open.

    4. Warning: Only select a port in the System Services list if you are certain it must be open.

  4. Click OK if you are finished making changes.

    5. If the System Services list does not have the application that needs access to the Internet, you need to add it to the list manually.

To add or edit a port for an application:

  1. Right-click the McAfee icon in the Windows system tray, point to Personal Firewall, then select Options.
  2. Click the System Services icon.
  3. Do one of the following:
    • To add a port for an application, click Add.
    • To edit a port for an application, click Edit.
  4. In the Edit Port Configuration dialog, specify the port settings:
    • Enter the program name.
    • Enter the program category.
    • Enter the incoming and outgoing TCP/IP port information.
    • Enter the incoming and outgoing UDP port information.
    • Enter the outgoing UDP port information.
    • Enter a description of the port.
    • Click OK.
  5. Select the application's checkbox.

Note: Clearing the checkbox blocks application traffic.

  6. Click OK to save your changes.

To remove or disable a port for an application:

  1. Right-click the McAfee icon in the Windows system tray, point to Personal Firewall, then select Options.
  2. Click the System Services icon.
  3. Do one of the following:
    • To remove a port for an application, click Remove. In the Remove System Service? dialog box, click Yes to remove the application.
    • To disable a port for an application, clear the application's checkbox
  4. Click OK to save your changes.


Traffic Monitor

Viewing the Traffic Monitor

The Traffic Analysis graph is a numerical and graphical representation of inbound and outbound Internet traffic. In addition, the Traffic Monitor shows those applications that currently use the most network connections on your computer and the IP addresses the applications access. The Traffic Monitor checks all your Internet connections and applications that use the Internet.

To use the Traffic Monitor:

  1. Right-click the McAfee icon in the Windows system tray, point to Personal Firewall, then select Options.
  2. Click Traffic Monitor.

The Traffic Monitor automatically updates its data every few minutes, but you can manually update the screens by clicking Refresh.

For more information about the Traffic Monitor, see:

  • Viewing statistics
  • Viewing application Internet activity


Statistics

Viewing Statistics

The Statistics page includes the following:

  • Traffic Analysis report
  • Traffic Usage report


Traffic Analysis

Viewing Traffic Analysis

Traffic Analysis shows real-time Internet activity on your computer. Traffic Analysis displays the volume and rate of recent incoming and outgoing Internet traffic on your computer, connection speed, and total bytes transferred across the Internet.

To view Traffic Analysis:

  1. Right-click the McAfee icon in the Windows system tray, point to Personal Firewall, then select Options.
  2. Click the Traffic Monitor icon.
  3. On the Traffic Monitor page, click the Statistics tab.

Traffic Analysis graph

The Traffic Analysis graph provides a visual representation of the data listed in the Current Statistic table (located below the graph). The graph shows the rate of kilobytes transferred in the last 15 minutes. To view the rate of transfer within the last 24 hours, click Change View located below the graph, then click View Traffic per Hour.

  • Inbound Traffic

    The solid green line represents the Current Rate of Transfer for incoming traffic. The dotted green line represents the Average Rate of Transfer for incoming traffic. If the Current Rate of Transfer and the Average Rate of transfer are the same, the dotted line does not appear on the graph. The solid line represents both the average and current rates of transfer.

  • Outbound Traffic

    • The solid red line represents the Current Rate of Transfer for outgoing traffic. The red dotted line represents the Average Rate of Transfer for outgoing traffic. If the Current Rate of Transfer and the Average Rate of transfer are the same, the dotted line does not appear on the graph. The solid line represents both the average and current rates of transfer.

Current Statistics Table

The Current Statistics table shows the volume of incoming and outgoing Internet traffic per minute. To view the volume of traffic in the last 24 hours, click Change View located below the graph, then click View Traffic per Hour.

Total Statistics Table

The Total Statistics table lists the total bytes of incoming and outgoing traffic since you last restarted your computer, for the current month, and for last month.


Traffic Usage

Viewing Traffic Usage

Traffic Usage displays the approximate percentage of bandwidth used by the most active applications on your computer since you last restarted your computer. A pie chart provides visual representation of the relative amounts of bandwidth used by the applications.

To view Traffic Usage:

  1. Right-click the McAfee icon in the Windows system tray, point to Personal Firewall, then select Options.
  2. Click the Traffic Monitor icon.

    3. The Traffic Monitor dialog box appears.

  3. Click the Statistics tab.

    4. Traffic Usage appears at the bottom of the dialog box.


Applications

Viewing application Internet activity

Personal Firewall allows you to review your application's Internet activity on the Traffic Monitor page. You can view applications:

  • Running on your computer.
  • Listening for inbound connections.
  • Acting as servers.

To view application Internet connection activity:

  1. Right-click the McAfee icon in the Windows system tray, point to Personal Firewall, then select Options.
  2. Click the Traffic Monitor icon.
  3. On the Traffic Monitor page, click the Applications tab.

    4. The Active Connections list shows applications that are currently running on your computer and accessing the Internet.

  4. Click an application to view the Traffic Analysis graph for the application.

    5. The graph shows the application's rate of inbound and outbound Internet traffic in the last 15 minutes.

    For more information about Traffic Analysis, see Traffic Analysis.

  5. Click the plus sign next to an application to view the application's Internet connections, or to view which applications are listening for connections.

    6. An application that is "listening" is prepared to accept inbound connections on one or more ports.


Updates

Updating Personal Firewall

McAfee SecurityCenter checks for updates to Personal Firewall every four hours while your computer is running and connected to the Internet. This ensures that you have the most up-to-date software components for Personal Firewall.

Note: You must be connected to the Internet to receive updates.

The Windows XP SP2 default Automatic Updates setting downloads and installs updates for the Windows OS and other Microsoft programs running on your computer without messaging you. When an application has been modified from one of Windows silent updates, McAfee Personal Firewall Plus alerts appear the next time the Microsoft application is run.


Troubleshooting

For more information about problems or errors you might be experiencing, see:

  • General issues
  • Configuring Microsoft® Internet Explorer


General issues

The following lists provides help on general problems or errors.

  • Personal Firewall has become unstable or unusable
  • My computer has been hacked
  • My computer cannot access the Internet
  • Open NetBIOS port
  • Unknown event type code
  • Installation issues in Windows 2000


Help! My computer cannot access the Internet!

Personal Firewall has become unstable or unusable

Personal Firewall may become unstable, unusable, or not exhibit expected behavior. In some cases, this can occur after you configure Personal Firewall with conflicting settings.

If you are unable to immediately identify and solve an issue, you may choose to do the following:

• Lockdown: Stop all incoming and outgoing Internet traffic to help you isolate and troubleshoot an issue.

For more information, see Enabling or disabling Lockdown.

• Reset Options: Restore Personal Firewall’s default settings.

Note: The Reset Options operation permanently deletes all existing settings. For more information, see Restoring your default settings.


Help! My computer has been hacked!

My computer has been hacked

The most important thing for you to remember is that your computer is behind a firewall. If you haven't opened any malicious programs, if you are being careful, and if your computer was not already compromised before you installed Personal Firewall, then you should be safe.

When you see an event in the log, it does not necessarily mean that someone tried to hack into your computer. It means that a certain type of packet came to the IP address you are currently using and Personal Firewall determined you didn't need it, so it blocked the packet.

A warning from Personal Firewall does not mean that someone has targeted your computer specifically. Warnings from Personal Firewall are divided into 3 categories:

Application Driven: The most common. An application you are using caused the firewall to be triggered. Look at the information provided about the event in the log view. If it mentions an application you are using, then most likely you can configure settings in the Personal Firewall Options to prevent this warning from happening again.

Random Probes: Even if a warning is created that has nothing to do with an application you are using, you still might not be a specific target. Many would-be hackers configure scanners to attempt to access random IP addresses over time. Due to the sheer number of 'script-kiddies' running these scanners, you can expect to be hit by one almost daily.

There are two important things to remember:

  • These probes are at random; they were not specifically targeted at you.
  • Personal Firewall STOPPED these probes from reporting back to the 'script-kiddie.' As far as the probing program knows, your computer does not exist, so the script-kiddie won’t know either.

True Attempts: If you receive multiple hits over time from a similar address, then there’s a chance someone is actually trying to hack into your computer. But the key is to err on the side of reason.

Don’t report every probe that hits your computer. If someone persistently pesters you, ban their IP, or collect as much data as possible before reporting them.


Help! My computer cannot access the Internet!

My computer cannot access the Internet

The most important thing for you to remember is that your computer is behind a firewall. If you haven't opened any malicious programs, if you are being careful, and if your computer was not already compromised before you installed Personal Firewall, then you should be safe.

When your computer cannot access the Internet, the first step is to allow full access to all necessary applications in the Internet Applications tab.

To change an application's permissions:

  1. Right-click the McAfee icon in the Windows system tray, point to Personal Firewall, then select Internet Applications.
  2. In the Permissions list, right-click the permission level for an application, then click Allow Full Access to allow the application to both send and receive data.


Open NetBIOS port

When you are using the 2nd and 3rd levels (Trusting, Standard) of security in Personal Firewall your computer will accept all UDP communication with computers that you initiate traffic with. Since you initiated the connection to the GRC site, Personal Firewall allows the NetBIOS query, which comes over UDP.

This is not dangerous unless you are in the habit of initiating communication with computers or people you do not trust. This might occur in peer-to-peer programs such as Kazaa or AIM. To prevent this from being a problem, either disable NetBIOS over TCP/IP in your Windows protocol settings or change the Personal Firewall’s security level to Tight.

To change Personal Firewall’s security setting:

  1. Right-click the McAfee icon in the Windows system tray, point to Personal Firewall, then select Options.
  2. Click the Security Settings icon.
  3. For the Security Level option, shift the slider to the Tight security setting.


Unknown event type code

"The event type code being reported is unknown. This should not happen. Please contact technical support."

If people are pinging you with unknown addresses, they are spoofing their IP addresses. The bad news is that we can't track that down, since the IP is wrong. The good news is that they can't learn anything about your computer or its contents.

Pings work kind of like the old "Self Address Stamped Envelopes" used by catalog companies. Think of the source IP as a "Return Address" on an envelope. When they ping, they're sending you an envelope with a return address in it, and they're asking you to put a piece of paper in the envelope saying that you exist and to send it back. But since they didn't put a real return address, even if Personal Firewall hadn't blocked it, your computer would have sent the return to an invalid address. So, in other words, do not worry about it.


Installation issues in Windows 2000 and XP

The event viewer in Windows 2000 can provide useful details about a Personal Firewall install if technical support is needed.

Note that this option is only available in Windows 2000, not in Windows 95, 98, or ME. Also note that we are referring to the Event Viewer built into Windows 2000, not the Personal Firewall Inbound Events log.

To open the Event Viewer and look for Personal Firewall Warnings or Errors:

  • Open Start | Programs | Administrative Tools | Event Viewer
  • Click on Application Log
  • Click on the "Source" Column to sort by source
  • Look for events with a Source of "MpfService"

If you see any events from Source "MpfService" with Type "Error", double click on them. To copy the contents, press the button the has two pieces of paper on it in the Event Properties window.

Then, if needed for technical support, paste these events into an email. The result should look something like:

Event Type:	Error
Event Source:	MpfService
Event Category:	None
Event ID:	2
Date:		4/17/2001
Time:		3:44:22 PM
User:		NT AUTHORITY\SYSTEM
Computer:	CIVIC
Description:
Filter Device I/O Proxy Thread could not open a vital shared memory resource.  This is a fatal error. Ensure multiple copies of application are not installed. If error persists, reinstall is suggested.


Configuring Microsoft® Internet Explorer

McAfee uses ActiveX controls and cookies to deliver applications via the Internet. These enabling technologies require specific browser configurations to ensure the applications are installed and work properly on your computer. Please follow the directions below to configure your browser.

  1. Determine which version of Internet Explorer you are using.

    2. a. Open Internet Explorer.

    b. On the Help menu, click About Internet Explorer to open the About Internet Explorer dialog box.

    c. Look for the line labeled Version: and note the first three numbers.

    Example: Version: 5.50.4807.2300. The bold numbers are where you should look. This version of Internet Explorer is 5.50, so you would use the "Configuring Internet Explorer 5.x" instructions.

  2. Click the appropriate link to learn how to configure your version of Internet Explorer:
    • Internet Explorer 5.x
    • Internet Explorer 6.x

After you configure Internet Explorer, it will have the correct security settings to download, install, and run McAfee Personal Firewall Plus, as well as other McAfee applications.


Configuring Internet Explorer 5.x

Configuring Microsoft® Internet Explorer 5.x

  1. Open Internet Explorer. On the Tools menu, click Internet Options to open the Internet Options dialog box.
  2. Click the Security tab. Make sure that you are in the Internet Web content zone and that the security level for this zone is set to Medium (the default setting) or Low.
  3. If you are not sure whether your security options are correct, click Default Level to set the zone to Medium (recommended).
  4. If you are an advanced user who wants to customize your security settings, click Custom Level to open the Security Settings dialog box. The McAfee Web site requires that the following options must be enabled.

    a. Select Enable for these ActiveX controls and plug-ins options:

      - Download signed ActiveX controls
      - Run ActiveX controls and plug-ins
      - Script ActiveX controls marked safe for scripting

    b. Select Enable for the Active scripting option under the Scripting settings.

  5. When you are done, click OK, then click Yes to confirm the changes.
  6. Click OK to close the Security Settings dialog box.
  7. Click OK to close the Internet Options dialog box.
  8. Exit Internet Explorer.


Configuring Internet Explorer 6.x

Configuring Microsoft® Internet Explorer 6.x

  1. Open Internet Explorer. On the Tools menu, click Internet Options to open the Internet Options dialog box.
  2. Click the Security tab. Make sure that you are in the Internet Web content zone and that the security level for this zone is set to Medium (the default setting) or Low.
  3. If you are not sure whether your security options are correct, click Default Level to set the zone to Medium (recommended).
  4. If you are an advanced user who wants to customize your security settings, click Custom Level to open the Security Settings dialog box. The McAfee Web site requires that the following options must be enabled.

    a. Select Enable for these ActiveX controls and plug-ins options:

      - Download signed ActiveX controls
      - Run ActiveX controls and plug-ins
      - Script ActiveX controls marked safe for scripting

    b. Select Prompt for these ActiveX controls and plug-ins options:

      - Download unsigned ActiveX controls
      - Initialize and script ActiveX controls not marked as safe

    c. Select Enable for the Active scripting option under the Scripting settings.

  5. When you are done, click OK, then click Yes to confirm the changes.
  6. Click the Privacy tab on the Internet Options dialog box, then click Advanced to open the Advanced Privacy Settings dialog box.
  7. Make sure that Override automatic cookie handling and Always allow session cookies are selected, then click OK to close the Security Settings dialog box.
  8. Click OK to close the Internet Options dialog box.
  9. Exit Internet Explorer.


Frequently Asked Questions

Why is an application blocked from Internet access when the firewall is set to Open security?

What's new in McAfee Personal Firewall Plus?

What should I expect when I first run Personal Firewall?

Why is a program requesting access to the Internet?

Why is a program requesting server access?

Why is explorer.exe requesting access to the Internet?

What is the difference between Outbound and Full access?

Why am I seeing an Application Has Been Modified alert?

What are Security Levels?

When do I need to open ports using System Services?

When I submit events to HackerWatch, why do they not appear immediately in my submitted events list?

What do the color-coded events mean in the Personal Firewall Log?

Does Personal Firewall work with Internet Connection Sharing?

How does Personal Firewall impact the performance of my computer?

What is a Trojan?

What is the vertical scale of the Traffic Monitor graph located on the Summary page?

How do I uninstall Personal Firewall?

Does Personal Firewall support Microsoft® Internet Information Services (IIS)?

Why does a blocked or allowed application no longer show in the Internet Applications tab?


Why is an application blocked from Internet access when the firewall is set to "Open" security level or "Disabled"?

Why is an application blocked from Internet access when the firewall is set to Open security?

Previously blocked applications continue to be blocked when the firewall is set to the Open. To prevent this, you can change the application's rule to Allow Full Access or remove the Blocked this Application rule from the Internet Applications list on the Internet Applications page.

To change an existing Internet application rule:

  1. Right-click the McAfee icon in the Windows system tray, point to Personal Firewall, then select Internet Applications.
  2. On the Internet Applications list, use either the Change Permission to pane or right-click an entry, to do one of the following:
    • Allow Full Access: Allow an application full Internet access.
    • Outbound Access Only: Allow an application outbound Internet access only.
    • Block This Application: Disallow an application Internet access.
    • Delete Application Rule: Remove the application from the Internet Applications list
    • Get More Information: Review information about the application.

    Note: If a rule exists for an application you attempt to change, Personal Firewall prompts you to reconfigure the rule.

For more information about working with application rules, see About the Internet Applications Page.


What's new in McAfee Personal Firewall Plus?

For more information, see New Features.


What should I expect when I first run Personal Firewall?

When you first run Personal Firewall, applications that you have installed on your computer might ask for access to the Internet. The amount and types of alerts you receive depend upon the alert settings for Personal Firewall. If you recognize and trust these applications, you should grant them access to the Internet. You will only see one alert per application, so Personal Firewall will alert you less frequently about new applications after a short period of time. To view which applications you have trusted, simply open Personal Firewall and click the Internet Applications tab.


Why is a program requesting access to the Internet?

Applications can request Internet access for the following reasons:

  • To check for automatic updates.
  • To retrieve information such as email, news, or music.
  • To communicate with a licensing server to verify rights to use an application.
  • To call another application, such as explorer.exe, rundll.exe, svchost.exe, in which to communicate with the Internet.


Why is a program requesting server access?

A program might request server access if it expects to receive anonymous connections from the Internet. Some examples of this might include online games, messenger applications, and file-sharing applications. Only grant an application server access if you recognize and trust the application and if you want it to be able to receive anonymous connections.


Why is explorer.exe requesting access to the Internet?

Explorer.exe is used by Internet Explorer to display “tree” diagrams of FTP sites.


What is the difference between “Outbound” and “Full” access?

Outbound access permits an application to communicate with other systems but not receive communications it did not initiate. Full access permits an application to not only make any connections it wants, but also permits the application to receive connections from other users.


Why does the Application Has Been Modified alert appear?

Why am I seeing an Application Has Been Modified alert?

This alert indicates that an application has changed since the firewall last let the application run. Typical changes can include:

  • Waol.exe: If you recently ran AOL and noticed that a TOD update was downloaded, you will see a modified application alert the next time AOL starts.
  • Iexplorer.exe: If you recently applied an automatic update or upgraded to your version, you will see a modified application alert.
  • Inetinfo.exe: If you use IIS, you will see a modified application alert as each new patch is applied.

Important: You should grant Internet access to an application if you continue to trust it. If you cannot think of a reason that the application has changed, then block Internet access from the application. Next, update your virus signature files for your anti-virus services, and scan of all your hard disks for viruses. If the anti-virus scan does not detect an infection, then grant Internet access to the application.


What are “Security Levels”?

Security levels are used to let users control how trusting their firewall should be of inbound and outbound traffic.

For more information about security levels, see Configuring Security Settings.


When do I need to open ports using System Services?

You only need to open ports using System Services if the application must accept unsolicited connections from other computers to work. Examples include:

  • Mail Server: You do not need to open a Mail Server port to receive email. You only need to open a port if the computer protected by Personal Firewall acts as an email server.
  • Web Server: You do not need to open a Web Server port in order to run a Web browser. You only need to open a port if the computer protected by Personal Firewall acts as a Web server.


When I submit events to HackerWatch, why do they not appear immediately in my submitted events list?

Data streaming into the HackerWatch servers is not immediately available for summary viewing. It must first be filtered and integrated with the other millions of events the system processes every day. The delay between your submitting the event and being able to manipulate the data on your personal screens at HackerWatch will vary from a few minutes to several hours depending upon the time of day and the total volume of traffic.


What do the color-coded events mean in the Personal Firewall Log?

  • Green entries are from a local IP or non-routable IP (e.g. 192.168.X.X).
  • Gray entries are from a possibly spoofed IP address, such as the loopback adapter (127.0.0.1) or an invalid IP (0.0.0.0).
  • Red entries are from banned IP addresses.

Help links are also included in the event description areas, which will further describe why you might be seeing events from these sources.


Does Personal Firewall work with Internet Connection Sharing?

All issues with ICS on all versions of Windows are corrected. There are no known conflicts with Personal Firewall and ICS.


How does Personal Firewall impact system performance and traffic?

There is very little performance impact. Potential resource consumption or slowdown occurs in two areas; CPU usage by the filter inspecting the traffic, and additional latency added by the time it takes the filter to inspect the packet before blocking or allowing it.

The CPU overhead is negligible. Even on a heavily loaded system it is difficult to measure. On older computers under 120 Mhz, there might be some measurable overhead.

Added packet latency is under 1 ms, and is negligible.


What is a Trojan?

A large portion of the mischief and malice done to personal computers across the Internet is performed through Remote Access Trojan programs, or RATs.

All Trojans are programs that contain a malicious payload. Frequently they appear to do something benign or beneficial. They might display a pretty animation or appear to be a utility of some sort (a famous Trojan of several years ago was an email client).

How do Trojans get on your computer? You put them there; therefore, it is very important that you exercise caution in where you obtain software. Never accept software from someone you meet in a chat room, for example. This is the #1 place where people get stuck with Trojans. Often people are tricked into thinking the program they are obtaining will do something for them, like help them play a game.

Many Trojans can do destructive things to your computer regardless of whether you are connected to the Internet or not. The bottom line is that if someone can get you to run his or her program, it is no longer your computer.

Only you can protect yourself completely. Putting too much faith in virus scanners, firewalls and other software only makes you less careful. Would you put on a bullet-proof vest, and then never worry about walking around where people were shooting? Always think it through.

Remember these key facts:

  • No firewall can protect you from Trojans. If you run a program that is a Trojan, it will get on your system unless it is blocked by an anti-virus program such as McAfee VirusScan Online.
  • The only way to prevent Trojans from attacking your computer is not to download software from un-trusted sources. Someone you met online is never a trusted source.


What is the vertical scale of the Traffic Monitor graph located on the Summary page?

The vertical scale of the graph changes depending upon the maximum amount of data your system has transferred recently. Under low traffic conditions, the total height of the scale represents approximately the maximum amount of traffic that can be transferred with a 56k modem. If you have a faster connection, and have transferred a larger amount of data, the scale of the graph expands to match the peak traffic for the period the graph covers. The scale of the inbound and outbound graphs is the same.


How do I uninstall Personal Firewall?

To uninstall Personal Firewall:

  1. Save all your work and close any open applications.
  2. Open Control Panel:
    • Windows 98, Me, and 2000 users: On your Windows taskbar, click Start, point to Settings, then click Control Panel.
    • Windows XP users: On your Windows taskbar, click Start, then click Control Panel.
  3. Open the Add or Remove Programs dialog box.
  4. Select McAfee Personal Firewall in the list of programs, then click Change/Remove.
  5. When you are asked to confirm the uninstallation, click Yes. The uninstallation begins.
  6. Click Reboot if you are prompted to restart your computer.
    Your computer will restart so that the uninstallation works properly.

When your computer restarts, Personal Firewall will have been uninstalled.


Does Personal Firewall support Microsoft® Internet Information Services (IIS)?

Personal Firewall is not intended for server-side use. Therefore, it does not include protection from IIS exploits. Personal Firewall users who run IIS put themselves at risk if they allow access to IIS and do not keep IIS security patches up-to-date.


Why does a blocked or allowed application no longer show in the Internet Applications tab?

If you blocked or allowed an application and later notice that the application no longer appears on the Internet Applications page, the application is no longer present on your computer. Applications that are no longer on your computer will not be listed in the Internet Applications page.

Note: If the rule that was created for the removed application still exists, and if the application is reinstalled on your computer, the last rule that was in effect will again be applied, if the application is the exact same version of the application that was removed. This also applies to programs that you blocked. That blocking rule will still be effective if the same version of the program is reinstalled on your computer.


About McAfee

About McAfee

Copyright


About McAfee

About McAfee, Inc.

McAfee, Inc., headquartered in Santa Clara, California and the global leader in Intrusion Prevention and Security Risk Management, delivers proactive and proven solutions and services that secure systems and networks around the world. With its unmatched security expertise and commitment to innovation, McAfee empowers home users, businesses, the public sector, and service providers with the ability to block attacks, prevent disruptions, and continuously track and improve their security.


Copyright

© 2005 McAfee, Inc. All Rights Reserved. No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language in any form or by any means without the written permission of McAfee, Inc.

TRADEMARK ATTRIBUTIONS

ACTIVE FIREWALL, ACTIVE SECURITY, ACTIVESECURITY (AND IN KATAKANA), ACTIVESHIELD, ANTIVIRUS ANYWARE AND DESIGN, CLEAN-UP, DESIGN (STYLIZED E), DESIGN (STYLIZED N), ENTERCEPT, ENTERPRISE SECURECAST, ENTERPRISE SECURECAST (AND IN KATAKANA), EPOLICY ORCHESTRATOR, FIRST AID, FORCEFIELD, GMT, GROUPSHIELD, GROUPSHIELD (AND IN KATAKANA), GUARD DOG, HOMEGUARD, HUNTER, INTRUSHIELD, INTRUSION PREVENTION THROUGH INNOVATION, M AND DESIGN, MCAFEE, MCAFEE (AND IN KATAKANA), MCAFEE AND DESIGN, MCAFEE.COM, MCAFEE VIRUSSCAN, NA NETWORK ASSOCIATES, NET TOOLS, NET TOOLS (AND IN KATAKANA), NETCRYPTO, NETOCTOPUS, NETSCAN, NETSHIELD, NETWORK ASSOCIATES, NETWORK ASSOCIATES COLLISEUM, NETXRAY, NOTESGUARD, NUTS & BOLTS, OIL CHANGE, PC MEDIC, PCNOTARY, PRIMESUPPORT, RINGFENCE, ROUTER PM, SECURECAST, SECURESELECT, SPAMKILLER, STALKER, THREATSCAN, TIS, TMEG, TOTAL VIRUS DEFENSE, TRUSTED MAIL, UNINSTALLER, VIREX, VIRUS FORUM, VIRUSCAN, VIRUSSCAN, VIRUSSCAN (AND IN KATAKANA), WEBSCAN, WEBSHIELD, WEBSHIELD (AND IN KATAKANA), WEBSTALKER, WEBWALL, WHAT'S THE STATE OF YOUR IDS?, WHO'S WATCHING YOUR NETWORK, YOUR E-BUSINESS DEFENDER, YOUR NETWORK. OUR BUSINESS. are registered trademarks or trademarks of McAfee, Inc. and/or its affiliates in the US and/or other countries. Red in connection with security is distinctive of McAfee brand products. All other registered and unregistered trademarks herein are the sole property of their respective owners.


Glossary

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

A

ActiveX controls
ActiveX controls are software modules based on Microsoft's Component Object Model (COM) architecture. They add functionality to software applications by seamlessly incorporating pre-made modules with the basic software package. Modules can be interchanged but still appear as parts of the original software.

ARP
ARP stands for Address Resolution Protocol and is used for communication over the Ethernet networks found in most offices. ARP converts the protocol Internet traffic uses for Web pages and email to the protocol the Ethernet card in your computer uses. If this is blocked, your computer will not understand the traffic coming from the network. The result is you cannot use email, the Internet, nor can you print on a network printer.

B

browser
A client program that uses the Hypertext Transfer Protocol (HTTP) to make requests of Web servers throughout the Internet. A Web browser graphically displays content for the browser user.

C

cookie
A cookie most commonly refers to a piece of information sent by a Web server to a user's Web browser. The browser software sends it back to the server whenever the browser makes additional requests from the server. When you visit a site you have previously visited and are welcomed by name, thank (or blame) a cookie that told them who you are.

country code
In the course of tracing intrusion attempts you will sooner or later encounter a country code. The country code is a two-letter tag at the end of a site URL which identifies the country where the site is located. See the on-line help for a detailed list of country codes.

D

DHCP
DHCP stands for Dynamic Host Configuration Protocol. It is a protocol used on many networks and by DSL and Cable providers to assign IP addresses to computers automatically (dynamic IP address). Every computer on an office network needs an IP address so it can log on to the network, get email, and connect to the Internet.

domain name system (DNS)
The Domain Name System simplifies Internet navigation. Computers on the Internet can only be found at their numerical IP address (e.g., 206.216.115.4). An address like "McAfee.com" makes sense to a human, but a DNS server must match it up to its real IP address. The DNS server databases are updated regularly as new domain names are registered.

domain name
An Internet site's unique name, which can consist of two or more parts separated by dots (McAfee.com, whitehouse.gov, www.chubu.ac.jp).

DSL
DSL or Digital Subscriber Line is an increasingly popular method of connecting to the Internet over regular phone lines. DSL offers the advantage of a relatively high speed connection at prices substantially lower than ISDN connections. In theory, DSL has a download speed limit of 9 megabits per second and an upload limit of 640 kilobits per second. In reality, and dependent of your provider's equipment as well as your computer equipment, you can expect anything from about 1.5 megabit download/128 kilobit upload (Asymmetric DSL) to 384 kilobits in both directions (Symmetric DSL).

E

email
Electronic Mail, messages sent via the Internet or within a company LAN or WAN. Email attachments in the form of EXE (executable) files or VBS (Visual Basic script) files have become increasingly popular as a means of transmitting viruses and Trojans.

F

finger
Software that allows you find out more information about an Internet user such as their real name and if they are logged on to a network or the Internet.

firewall
Hardware and/or software designed to keep unauthorized outsiders from tampering with a computer system or network. That system can be a standalone computer, a small LAN or a company-wide network or WAN with thousands of users. Personal Firewall is a software firewall effective in protecting standalone computers and small networks.

FTP
FTP or File Transfer Protocol is used to move files between Internet sites. When you "download" a file from a site, e.g. a virus program update, you might be using FTP. Public FTP sites from which you can download program or driver updates are usually anonymous FTP servers that permit anonymous logins. Private FTP sites normally require a Login name as well as a password and those who use them regularly, usually make use of specialized FTP programs.

G

H

hit
A "hit" is a single request from a Web browser for a single item from a Web server. A single Web page with text and graphics will require multiple hits in order to acquire the complete page. The number of hits required to get the entire page, the size of graphic files, the speed of your connection and the transfer speed of all the various nodes between your browser and the Web site all add up to a page that appears in seconds or one that comes in very slowly.

HTTP
HyperText Transfer Protocol moves hypertext (HTML) files on the Internet from the server you are visiting to the browser you are viewing with.

I

ICMP
ICMP stands for Internet Control Message Protocol. It is a troubleshooting tool used by technicians to find errors on a network, and it communicates errors on a network as they occur. Unfortunately, hackers can also use it to interfere with and redirect communications. Hackers do this to get information such as account numbers, credit card numbers, and other information. Thankfully, ICMP is usually not necessary, and it can be blocked without causing problems.

Internet
The Internet consists of a huge number of inter-connected networks that use the TCP/IP protocols for the location and transfer of data. The Internet evolved from a linking of university and college computers (in the late 1960s and early 1970s) funded by the U.S. Department of Defense and called the ARPANET. The Internet today is a global network of almost 100,000 independent networks.

Intranet
A private network, usually inside an organization, that functions very much like the Internet. It has become common practice to permit access to Intranets from standalone computers used by students or employees off-campus or off-site. Firewalls, login procedures and passwords are designed to provide security.

IP address
The Internet Protocol Number or IP address is a unique number consisting of four parts separated by dots (e.g. 63.227.89.66). Every computer on the Internet from the largest server to a laptop communicating through a cell phone has a unique IP number. Not every computer has a domain name but everyone has an IP.

ISDN
Integrated Services Digital Network is yet another way of moving data at high speed over existing phone lines (see DSL). ISDN is widely available and with increasing pressure from DSL providers, cost is coming down. While a 128,000 Bps rate is theoretically possible, most users find that reality is in the 56,000 to 64,000 Bps range.

ISP
Internet Service Provider. This is the service you subscribe to in order to connect with the Internet. It can be a small local company with a few thousand subscribers, a regional company (e.g. uswest.net) or a nationwide mega-provider like A.O.L. or AT&T WorldNet. Most ISPs sell you a connection, nothing more. They provide no security whatsoever and if your computer is hacked and subsequently damaged or destroyed, they do not owe you the time of day. On the other hand if you are a hacker or violate any of the fine print in your ISP service agreement, they can cut off your Internet access before you can say World Wide Web.

J

K

L

LAN
Local Area Network. Two or more computers that are linked together and able to share programs, data and/or peripherals.

M

MIME
Multipurpose Internet Mail Extensions, MIME, is the standard format used for transmitting files attached to email messages (pictures, sound files, video files, executables, etc.). The attachment is encoded when it leaves your computer and is decoded and restored to its original form at the receiving end. The specific encoding/decoding format for a given file varies with the file type. Once in a great while you might receive a MIME format attachment, essentially an attachment that was not properly encoded or decoded. If you open it and look at it, it will appear to be indecipherable gobbledygook.

modem
MOdulator/DEModulator. Your modem takes data you are sending and modulates it so that it can be transmitted over an analog voice phone line. Your modem accepts incoming modulated data and demodulates it so that it is usable by your computer. The earliest modems required the user to place the telephone handset into a cradle with padded apertures for the two ends of the handset. Speeds were in the range of 300 to 1,200 Bps. With improvements in error correction, modems today under ideal conditions can transmit data at over 50,000 Bps. over a single phone line. DSL and ISDN connections offer even higher speeds. These days the term modem is frequently used to describe external network connection devices that do not actually perform any modulation or demodulation, such as DSL and Cable modems which are actually digital end-to-end.

N

NAT
Network Address Translation. The process of converting between IP addresses used within an intranet or other private network and Internet IP addresses. This makes it possible to use a large number of addresses within the private network without depleting the limited number of available numeric Internet IP addresses.

network
When you connect two or more computers, you create a network. When you connect two or more networks you create an internet (lower case "i").

node
A single computer connected to a network. When you ask Personal Firewall to perform a trace, the Visual Trace Express trace list shows you all of the nodes between your computer and the source of your intrusion event. The nodes simply served as connection points in passing along the data.

O

P

password
A code (usually alphanumeric) you use to gain access to your computer or to a given program or to a Web site.

PING
Packet Internet Groper is a program used to determine whether a specific IP address is accessible. A packet is sent to the specified address and the program waits for a reply. Programs like Visual Trace and Visual Trace Express use PING to identify and/or troubleshoot Internet connections. In addition to identifying the target site, these programs also note all of the nodes the data passed through between the two ends of the connection.

port
A place where information goes into and/or out of a computer, e.g. a conventional analog modem is connected to a serial port. The port numbers in TCP/IP communications are virtual values used to separate traffic into application-specific streams. The ports (destination and source) captured in the Personal Firewall Inbound Events log are significant because different applications listen and transmit on different ports. Ports are assigned to standard protocols like SMTP or HTTP so that programs know what port to try a connection on. The destination port for TCP packets indicates the application or server being looked for. In the case of UDP packets the source port has more significance.

PPP
Point to Point Protocol allows a computer to use a regular phone line and modem to make TCP/IP connections to the Internet.

proxy
 A computer (or the software that runs on it) that acts as a barrier between a network and the Internet by presenting only a single network address to external sites. By acting as a go-between representing all internal computers, the proxy protects network identities while still providing access to the Internet. See also Proxy Server.

proxy server
 A firewall component that manages Internet traffic to and from a local area network (LAN). A proxy server can improve performance by supplying frequently requested data, such as a popular Web page, and can filter and discard requests that the owner does not consider appropriate, such as requests for unauthorized access to proprietary files.

Q

R

S

Script Kiddie
A typically unsophisticated self-styled ‘hacker’ who attempts to hack into or otherwise abuse systems without understanding what her or she is doing. Script Kiddies employ tools (often scripts), which automate hacking through the use of specific known and well understood system weaknesses and exploits. They will frequently scan large numbers of IP addresses attempting to find systems that are vulnerable to the tool they are using.

server
A computer or software that provides specific services to software running on other computers. The "mail server" at your ISP is software that handles all of the incoming and outgoing mail for all of your ISP's users. A server on a LAN is hardware that constitutes the primary node on the network. It can also have software which provides specific services, data or other capabilities to all of the client computers attached to it.

SMTP
Simple Mail Transfer Protocol is a set of rules governing the sending and receiving of email on the Internet.

SNMP
Simple Network Management Protocol is a set of standards governing communication with devices connected to a TCP/IP network. This communication takes the form of Protocol Data Units or "PDU's."

SSL
Secure Sockets Layer, a protocol created by Netscape Communications to enable encrypted, secure communications across the Internet. Internet banking, securities and e-commerce sites commonly use SSL.

T

TCP/IP
TCP/IP (Transmission Control Protocol/Internet Protocol) is the basic communication language or protocol of the Internet. It can also be used as a communications protocol in a private network (either an intranet or an extranet). When your computer is set up with direct access to the Internet, your computer gets a copy of the TCP/IP program. Every computer that you send messages to or get information from also has a copy of TCP/IP.

top-level domain
Top Level Domains (TLDs) are the most common domain name extensions. The most familiar of these is the ubiquitous "dot com" but there are others in common usage:

  • .com (US Commercial)
  • .edu (US Educational)
  • .gov (US Government)
  • .int (International)
  • .mil (US Military)
  • .net (Network)
  • .org (Non-Profit Organization)

Trojan Horse
A type of computer worm or virus which comes to you disguised as a desirable program. The name is based on the famous Trojan Horse which was left outside the walls of Troy by a departing army which appeared to have given up its plans of conquest. The horse, which concealed a band of soldiers, was brought into the walled city by its unwary inhabitants. The soldiers opened the gates of the city in the middle of the night and Troy was destroyed by the returning troops.

U

UDP
User Datagram Protocol. UDP converts data messages generated by an application into packets to be sent via IP.

URL
Uniform Resource Locator. This is the standard format for Internet addresses.

USENET
More commonly called Newsgroups, USENET is a decentralized worldwide community made up of almost 20,000 discussion groups covering almost every conceivable area of interest. Rule of thumb: do not accept software from someone you meet in a newsgroup or chat room!

V

Visual Trace
Powerful geographical Internet tracing program. Visual Trace uses a proprietary database system maintained by the McAfee Web site to determine and provide location information on routes and IP addresses.

VPN
Virtual Private Network, a network which makes use of the Internet to connect computers that are in different locations. Communication is encrypted for security.

W

WAN
Wide Area Network, a network of computers that covers an area larger than a single building or campus. In the past WANs have been private networks connecting geographically separated offices of the same organization. WANs are rapidly being replaced by the Internet and the wide use of VPNs.

WWW
their browser but in reality the Web now encompasses all of the resources that make up the Internet including such things as FTP sites, USENET, and much more.

X

Y

Z


About ActiveX Controls

ActiveX controls are software modules based on Microsoft's Component Object Model (COM) architecture. They add functionality to software applications by seamlessly incorporating pre-made modules with the basic software package. Modules can be interchanged but still appear as parts of the original software.

On the Internet, ActiveX controls can be linked to Web pages and downloaded by an ActiveX-compliant browser. ActiveX controls turn Web pages into software pages that perform like any other program launched from a server.

The McAfee Web site uses ActiveX controls in its applications, and you must download the specific ActiveX components required for each application. Once these components are loaded, you do not need to download them again unless upgrades or updates become available.

Unfortunately, Netscape Navigator (and some CompuServe versions) are not ActiveX-compliant browsers. To use McAfee applications with Netscape Navigator or CompuServe, you must go to the McAfee Web site to automatically download the McAfee Activator Plug-in and have Internet Explorer version 5.0 or later installed on your computer.

Note: Netscape Navigator 4.0 and later versions, as well as CompuServe 5.0 and later versions, are compatible with the McAfee Activator Plug-in.


McAfee and cookies

McAfee uses software tags called "cookies" to identify customers when they revisit the Web site. Cookies are blocks of text placed in a file on your computer's hard disk. A cookie is used to identify you the next time you access the site.

McAfee uses cookies to:

  • Manage your subscription permissions and rights
  • Identify you as a returning user so you don’t need to re-register every visit
  • Help understand your buying preferences and customize services to your needs
  • Present information, products, and special offers likely to interest you

McAfee also asks you to provide your first name so we can personalize your McAfee experience.

McAfee cannot provide subscription services to users whose browsers are set to reject cookies. McAfee does not sell, rent, or share the information collected with any outside parties.

McAfee allows advertisers to set cookies in visitors' browsers. McAfee does not have access to the information contained in advertisers' cookies.


Accept ICMP Ping Requests

You can specify the behavior of blocking and logging for ICMP traffic.

ICMP traffic is used mainly for performing traces and pings. Pinging is frequently used to perform a quick test before attempting to initiate communications. If you are using or have used a peer-to-peer file-sharing program, you might find your computer being pinged a lot.

To accept ICMP ping requests:

  1. Right-click the McAfee icon in the Windows system tray, point to Personal Firewall, then select Options.
  2. Click the Security Settings icon.
  3. Check Accept ICMP ping requests.
  4. Click OK to save the setting.

Note: You must select Log the Event in the Event logging list before Personal Firewall logs any ping requests.


Active Applications

  • Active Applications: Active Applications shows the bandwidth usage of your computer’s most active applications during the last 24 hours.
  • Application: The application accessing the Internet.
  • %: The percentage of bandwidth used by the application.
  • Permission: The type of Internet access that the application is allowed.
  • Rule Created: When the application rule was created.


Animate slide-in alerts

Personal Firewall can animate slide-in alerts on your Windows desktop.

To animate slide-in alerts:

  1. Right-click the McAfee icon in the Windows system tray, point to Personal Firewall, then select Options.
  2. Click the Alert Settings icon.
  3. On the Alert Settings page, check A nimate slide-in alerts. Alternatively, clear the checkbox to receive standard popup alerts.
  4. Click OK to save the setting.


Application Recommendations

You can choose to automatically use, ignore, or view application recommendations that Personal Firewall provides to help you handle application alerts.

To specify application recommendations settings:

  1. Right-click the McAfee icon, point to Personal Firewall, then select Options.
  2. Click the Alert Settings icon.
  3. From the Smart Recommendations drop-down on the Alert Settings page, select one of the following options:
    • Do Not Use Smart Recommendations:
    • Display Smart Recommendations only:
    • Use Smart Recommendations:
  4. Click OK to save the setting.

Note: If you choose to show recommendations, Personal Firewall displays the recommendations on the application alerts.


Auto-hide non-critical alerts

To configure Personal Firewall to automatically hide non-critical alerts:

  1. Right-click the McAfee icon in the Windows system tray, point to Personal Firewall, then select Options.
  2. Click the Alert Settings icon.
  3. Check Auto-hide non-critical alerts after 10 seconds. Clear the checkbox to keep alerts visible.
  4. Click OK to save the setting.


Directed Attack

Event data that falls into this category can be very serious. A directed attack simply means that it is not part of an automated scan or random unwanted traffic. There is a person on the other end and they probably know what they are doing.

If you continue to see activity of this nature you should consider disconnecting for awhile.


Event Logging

You can choose whether to log events, monitored by Personal Firewall.

To enable event logging:

  1. Right-click the McAfee icon in the Windows system tray, point to Personal Firewall, then select Options.
  2. Click the Event Log Settings icon.
  3. On the Event Log Settings page, in the Inbound Events Logging Settings drop-down, select one of the following options:
  • Log the Event
  • Do Not Log the Event
  4. Click OK if you are finished making changes.

If you choose to log events, Personal Firewall displays them in the Inbound Events log of the Inbound Events page.

For more information about event logging, see Configuring Event Log Settings.


What is the difference between “Outbound” and “Full” access?

Explorer.exe is used by Internet Explorer to display “tree” diagrams of FTP sites. If you use Tight Security, explorer.exe should be granted outbound access only, and not server access.


Multiple IP Addresses

Your computer has multiple IP Addresses because you have more than one network adapter devices on your computer.

The adapters may be physical or virtual. Examples of physical devices include network cards and modems. Examples of virtual adapters include VPN and PPPoE drivers.


Configuring Your Firewall Options

Test My Firewall

You can test your Personal Firewall installation for possible vulnerabilities to intrusion and suspicious activity.

You can test your firewall from two locations in Personal Firewall:

  • The McAfee SecurityCenter
  • The McAfee system tray icon

To test your Personal Firewall installation from McAfee SecurityCenter:

  1. From the McAfee SecurityCenter, click Options.
  2. On the Options page, click Test My Firewall.

Personal Firewall launches Internet Explorer and opens http://www.HackerWatch.org, a Web site maintained by McAfee. Follow the directions on the HackerWatch.org Probe page to test Personal Firewall.

To test your Personal Firewall installation from the McAfee icon in the Windows system tray:

  • Right-click the McAfee icon in the Windows system tray, point to Personal Firewall, then select Test Firewall.


Configuring Your Firewall Options

Track an Attack

Track an Attack quickly traces the source of hostile attacks as well as other Internet traffic connecting to or trying to connect to your computer. The type of tracking information you can find includes an easy-to-read graphical map showing the location of an intruding source and, if available, key contact and owner information from the originating IP address.

To track an attack:

  1. From the McAfee SecurityCenter, click Options.
  2. On the Options page, click Track an Attack.
  3. In the Track an Attack dialog box, URL, host name, or IP address to track.
  4. Click Track.
  5. The Tracer page provides three views to track the attack.
  • Map View: Geographical map pinpointing the location of the target computer connection to your computer.
  • Registrant View: Public registration information about the domain you tracked, such as the domain name, registrant's name and address, and administrative contact.
  • Network View: View available information about the network on which the domain resides.

For more information, see Visual Trace.


Port Comparison

The port comparison pie chart shows ports that have experienced frequent connection attempts for the the past 30 days. You can click a port name to view details in the Inbound Events page.


Show port numbers in log view

This displays the source and destination ports of an event on Personal Firewall's Inbound Events page, along with the source and destination IP addresses, and other event information.

To show port numbers in log view:

  1. Right-click the McAfee icon in the Windows system tray, point to Personal Firewall, then select Options.
  2. Click Event Log Settings.
  3. Click the Event Log Settings tab.
  4. Select Show port numbers in log view. Clear the checkbox to hide the port numbers in log view.


Report This Event

This option reports a selected event to HackerWatch.org.

  1. Click the Events tab on the Personal Firewall main window.
  2. Select an event in the log.
  3. Click Report This Event on the bottom right of the main window.


Application Summary Page

The inbound and outbound traffic volume across your Internet connection in the last ten minutes. Click the graph to view traffic monitoring details.

  • Active Applications: Active Applications shows the bandwidth usage of your computer’s most active applications during the last 24 hours.
    • Application: The application accessing the Internet.
    • %: The percentage of bandwidth used by the application.
    • Permission: The type of Internet access that the application is allowed.
    • Rule Created: When the application rule was created.
  • What’s New?: What’s New? shows the latest application that was granted full access to the Internet.
  • Active Applications: Active Applications displays the applications that are currently running on your computer and accessing the Internet. Click an application to view which IP addresses the application is connecting to.
  • Common Tasks: Click a link in Common Tasks to go to Personal Firewall pages where you can view application status and perform application-related tasks.


Event Summary Page

To open the Event Summary page from another Summary page, click Change View, then click Event Summary. The Event Summary page provides the following information:

  • Port Comparison: Shows a pie chart of the most frequently attempted ports on your computer during the past 30 days. You can click a port name to view details in the Inbound Events page. You can also move your mouse pointer over the port number to see a description of the port.
  • Top Offenders: Shows the most frequently blocked IP addresses, when the last inbound event occurred for each address, and the total number of inbound events in the past thirty days for each address. Click an event to view event details in the Inbound Events page.
  • Daily Report: Shows the number of inbound events that Personal Firewall blocked today, this week, and this month. Click a number to view the event details in the Inbound Events log.
  • Last Event: Shows the latest inbound events. You can click a link to trace the event or to trust the IP address. Trusting an IP address allows all traffic from the IP address to reach your computer.
  • Common Tasks: Contains links to Add Trusted IP Address, Add Banned IP Address, and View Inbound Events.


HackerWatch Summary Page

To open the HackerWatch Summary page from another Summary page, click Change View, then click HackerWatch Summary. The HackerWatch Summary page provides information on global intrusion activity. This page also has links that take you directly to HackerWatch.org where you can get more information on hacker activity, view a list of events you reported to HackerWatch.org, and more.

  • World Activity: Shows a world map identifying recently blocked activity monitored by HackerWatch.org. Click the map to open the Global Threat Analysis Map in HackerWatch.org.
  • HackerWatch Resources: Shows current security-related activity, such as virus outbreaks, and provides links to HackerWatch for additional information.
  • Event Tracking: Shows the number of inbound events submitted to HackerWatch.org.
  • Global Port Activity: Shows the top ports, in the past 5 days, that appear to be threats. Click a port to view the port number and port description.
  • Common Tasks: Contains a link to HackerWatch.org pages where you can review information on world-wide hacker activity.


Main Summary Page

The Main Summary page provides the following information:

  • Security Setting: Indicates the level of security at which the firewall is set. Click the link to change the security level.
  • Blocked Events: Displays the number of events that have been blocked today. Click the link to view event details in the Inbound Event page.
  • Application Rule Changes: Displays the number of application rules that have been recently changed. Click the link to view the list of allowed and blocked applications and to modify application permissions.
  • What’s New?: Displays the application mostly recently granted full access to the Internet.
  • Last Event: Displays the latest inbound events. You can click a link to trace the event or to trust the IP address. Trusting an IP address allows all traffic from the IP address to reach your computer.
  • Daily Report: Displays the number of inbound events that Personal Firewall blocked today, this week, and this month. Click the link to view event details in the Inbound Event page.
  • Active Applications: Displays the applications that are currently running on your computer and accessing the Internet. Click an application to view which IP addresses the application is connecting to.
  • Common Tasks: Lists common tasks, including View Current Internet Traffic, Change Firewall Settings, and View the Online Help.


Top Offenders

Top Offenders shows the most frequently blocked addresses, when the last inbound event occurred for each address, and the total number of inbound events in the past thirty days for each address. Click an event to view details in the Inbound Events log.


Traffic Monitoring

Traffic Monitoring shows inbound and outbound traffic volume across your Internet connection in the last ten minutes.

To view Traffic Monitoring details:

  • Click the graph. The Traffic Monitor dialog box appears. For more information about the Traffic Monitor, click Help on the Traffic Monitor dialog box.


Visual Trace

Visual Trace quickly tracks the source of hostile attacks as well as other Internet traffic connecting to or trying to connect to your computer. The type of tracking information you can find includes an easy-to-read graphical map showing the location of an intruding source and, if available, key contact and owner information from the originating IP address.

  • Map View: View the geographical map pinpointing the location of the target computer connecting to your computer.
  • Registrant View: View public registration information about the domain you traced, such as the domain name, registrant's name and address, and administrative contact.
  • Network View: Retrieve available information about the network that the domain resides on.