Okay first things first: Computer OS and Software
XP Home SP3
McAfee Internet Security
Security Center version 11
Okay, so my XP just auto updated to version 11 for Mcafee today and it asked me to restart. Okay that is standard routine and I restarted. After that I went to check my About link and saw that 5 things were update also normal, compare to my Vista Home laptop. When I went to check my Incoming Events in the History and Logs, I would sometimes see an event from an ip address trying to access my udp port 25701 when I turned off my computer yesterday.
However, this was not true. There were multiple different ips (as far as I can tell) trying to accessing that port. The events were happening maybe seconds within each other. An example would be at 9:40:30 am, one event, 9:40:35 am another event with a different ip. There were also events where there was may 2 to 3 different ips trying to access the port at the same time (down to the seconds). The events are happened after I restarted my computer and I didn't start up firefox, or internet explorer yet. I am also not gaming or file sharing.
I check my firewall setting for McAfee and everything was the same before the update. The only thing that was new or add was that there was a program called McAfee 32-bit Helper that was added to my list of Allowed Programs and the Net Guard function. Since the new program had McAfee as part of its name and I remember seeing it on the list on my laptop, I knew it was legit since my laptop doesn't get any activities logged except for events when my router ip is trying to access my ports.
I don't know if this will help or not, but for the XP I have had my Windows firewall turned off even since I installed McAfee on it after a Hard Drive change in Janurary 2010. As for the McAfee firewall it does say it is on and I have the Security Level set to Shealth and it has been since 2010. I also, checked the box that used to say Enable Protection during startup, which now says Block Internet access at Startup in the Smart Advice and Advance Settings. I also, only use my XP for checking my emails, gamespot forums, printing out word documents, paying for tuition, sometimes I bittorrent but I get it from reliable source rather than suscipous places like torrentreactor (marked unsafe by siteadvisor). So basically, once I am done checking my email and the forums, I would turn off my XP unless, I see that from one of my sources they released something I want to see. I would torrent and after watching it I would delete it since, youtube remove those videos.
Also, I already scanned my computer two weeks ago and it said that it was clean. The only thing I did during the two weeks was email, forum, and printed out 3 essays.
Also, I forgot to mentioned that all of these events on my port, my firewall says "A PC at the ip has tried to access one of your system ports (UDP port 25701). If you want to allow this traffic, either trust the IP address or open the port in the System Services in Firewall.
I checked the Port and System Services option in the Firewall and the only ones that are checked off are the same as my laptop. So, the default, since I never touched this setting.
As I said iun your other thread, 'the new software reads things differently I guess. Those are all blocked attempts anyway so you shouldn't be concerned with them.'
That tab is really simply there to give McAfee's Firewall bragging rights on how it is protecting you. No need to be worried about it.
Unfortunately because processes are proprietary McAfee wont give us exact details of how the various processes work so that is the stock response we get.
I see, even though the attempts were blocked. Is there any chance that one of those ip address will break/get through McAfee Firewall? Should I turn back on my Windows Firewall, even though XP says that having two may cause problems.
Also, since I wasn't too sure about the 32-bit Helper, I actually removed from the list of Allowed Programs. It wasn't until I went on my Vista with Version 11 did I see that the 32-bit Helper was there too.
As for the new software reading things differently, I can't be too sure but on my computer that still has 10.5.221. I believe that in its logs, it logs that every couple minutes my router's ip is trying to accessing a different port everytime.
But, yea I was worried since before the 25701 port event happens when I shutdown my computer, but now it happens like every second from Startup till Shutdown.
Also, I asked my ISP technical supoort and the lady said that it sounds like I have spyware. But, as I mentioned before everything was fine before this update and full scan showed clean two weeks ago, so could she be right?
Those logs are telling you what is blocked and will remain blocked. Don't turn on Windows Firewall as operating 2 software firewalls can actually let stuff in. You also shouldn't interfere with McAfee processes as in the 32-bit helper.
The software acts best when it is left to do its own thing.
If you have any further questions I suggest contacting Technical Support Online Chat via the link in Useful Links at the top of this page as these technicalities are outside the scope of these forums and beyond the abilities of use mere Moderators.
No and in any case email support would be extremely slow. You install McAfee Virtual Technician, which can be uninstalled afterwards via Control Panel/Programs in the normal manner and a browser helper is installed for the actual chat session I believe. I assure you it's all safe.
I was wonder could you pass this topic or notify someone who knows more about the Mcafee firewall to help? Not that your answer isn't helpful, but I am looking for a more definite answer/explanation. I kinda don't want to contact technical support because last couple of time with live chat, they weren't much help.
Also, to add to my description of the problem, I believe my hard drive light was flashing even though I wasn't doing anything on my computer. Of course, it was flashing the whole time, just occassionally like in a minute it flash 3 times. When I mean three times I meant that it flashes a little and then the light is fully lit for a couple seconds and then turns black. That whole thing would be considered once.
Jayadeep NR should be able to answer some questions as he is McAfee Support staff. As far as the light flickering indicating hard drive activity, that's normal for any system. Windows could be consolidating files, or software, McAfee for instance, could be polling for updates. Not all hard drive activity has to be initiated by a human, Windows has many processes that run periodically.
If you are really worried about malware download the FREE version of THIS software. Update it before running it.
Yea, when my isp tech help said that this activity sounds like adware I ran malwarebytes, but only a quick scan. Only items it found was 2 pum.disabled.securitycenter or something like that, which I know those 2 files are dangerous.
As for the hard drive light, I asked because usually when I leave the computer alone its light doesn't flash.