Why does not ZA Fw alert?

polonus · 2006-10-22T19:00:15.000Z

Hi malware fighters,

Well visiting a site with my browser via http: 80 I was alerted that a NMap Null Scan was thwarded via port 1449. Why wasn’t I also alerted by ZA firewall. What firewall protects from these scans. Why an av solution alerts and a fw is silent.

polonus

DavidR · 2006-10-22T21:24:26.000Z

I was alerted that a NMap Null Scan was thwarded via port 1449.

You don't say what alerted you (why an av solution alerts you) ?

Is it possible that what alerted you got in there before ZA ?
Could this possibly be Network Shield ?

polonus · 2006-10-22T21:35:07.000Z

Hi DavidR,

That was actually what it was, but I want to know how much I am at risk, because it was the first time I experienced that when visiting the website I was alerted to a scan.

polonus

DavidR · 2006-10-22T21:51:49.000Z

The problem with the Windows boot you can’t select the order applications are loaded so it is possible ZA (you didn’t say if it’s the free or pro, I assume free) isn’t getting loaded or something is delaying or slowing it and Network Shield gets in there first.

As to if you are at risk, I wouldn’t have thought so as Network Shield is effectively doubling up protection on the common attack ports and ZA should be stealthing and or covering the rest. What concerns me is if Network Shield gets in first and blocks an attack, effectively signalling your presence, which could attract further attention.

I suggest a full shields-up check at grc.com and see if you are stealthed, you probably will be, because any activity on the ports avast monitors is unlikely to find malicious content and ZA would effectively be the next in line.

Lisandro · 2006-10-22T22:09:42.000Z

polonus post:1:

Why wasn’t I also alerted by ZA firewall.

Are you using the Home version? Maybe there something in the logs… maybe only the Pro version does this…

DavidR · 2006-10-22T23:20:10.000Z

Why wasn't I also alerted by ZA firewall.

Sorry just noticed that bit after Tech commented about it.

My thought is you wouldn’t also get an alert from ZA as the Network Shield has intercepted the connection attempt so ZA won’t even see it.

Lisandro · 2006-10-22T23:22:57.000Z

DavidR post:6:

My thought is you wouldn’t also get an alert from ZA as the Network Shield has intercepted the connection attempt so ZA won’t even see it.

I’m not sure but I think a good firewall will intercept this connection before NetShield :

DavidR · 2006-10-22T23:52:52.000Z

Well Network Shield effectively blocks the download and if it blocks the download it is loading before the firewall, in which case the firewall won’t know about the attempt.

ZA free and pro I would have thought would fall into that category of a good firewall intercepting before Network Shield, but as I said there is no control on application loading on boot (by default). I don’t know if I would want to use something like Startup Delayer to delay the start of avast to try to let ZA load first. To me it seems to be a loading problem rather than a good/bad firewall issue.

system · 2006-10-24T09:50:07.000Z

I had never been alerted about a scan with ZA enabled though my Network Shield is active.

polonus, what is your ZA version?

Are you sure ZA is fully functional?

polonus · 2006-10-24T14:29:39.000Z

Hi NickGolovko,

The ZA is 6.5.737.000. The truth of the matter is that there was a conflict between that ZA version and the Torpark browser I was using at that moment. Why I cannot imagine but after using Torpark for a while the ZA client closes down and must be restored through reboot, very irritating behaviour of ZA. After that experience I have given up on that Torpark version (checked the checksum on downloading, but there are more experiencing strange ZA client behavior using Torpark and ZA at the same time. (Some had to install ZA anew after downloading Torpark). Then I had the Nmap null alert from the av. Why ZA conflicts with the Torpark (firefox with tor-router browser)?

polonus

Announcements