Had over 20 security alerts in Norton FireWall 2003 over a span of four hours. This is driving me crazy... since I am using programs to help me from getting attacked. The programs that I am using are: Norton AntiVirus 2003 Norton FireWall 2003 Norton CleanSweep MRU-Blaster SpywareBlaster Ad-aware SpyBot All are updated on a daily basis. I also use RegCleaner 4.3 to clean unwanted items. I have had attacks before in the past, but nothing like this. My main source for the internet is XP, but I also have 98se on this partitioned computer. 98se I use for games/etc. I connected to the internet using my ISP in 98se and still got attacked 4 times in about 15 min. I contacted my ISP and they said there is nothing that is out of the ordinary on their end. They said it has to be something I am viewing or downloading. I only use the internet for checking my email and to do updates from time to time. Nothing ilegal goes through my system. Thinking that I may have a virus I did a complete run of the system in both windows versions and nothing. Is there anyway to find out why I am receiving these alerts? If it was a prank I would think that all the tracking would show one specific area on the tracking map or the world, but all had different locations. Please Help!

sprank, What were you being warned about? You know, like were these ICMP echo requests, a PING. That you received the warning about. Or, was it something else? Try dealing with 400 to 800 a session. A session, will range between two, and five hours ;-) What's driving me crazy, is people, NOT checking for viruses, trojans, worms, ect., and not keeping things updated. Well, won't go into that any further. I'll get to _____, just thinking about it. Those people, sure do keep my different log files large. Yes, ISP's ;-) You give them the information, so hopefuly things will be taken care of, but that isn't always so. Sorry, couldn't be of any help. Good Luck I’ll Try p.s. the alerts you're seeing, might be caused, by problems(as indicated above) on another persons computer.

Sprank, as I'll Try said, it could be that you're getting hit by some other PC(s) on your subnet that are infected. They're just looking for open Windows PC's that they can infect. Again, they might not even know (mostly likely not) they are infected. It happens all the time. One PC in a subnet is infected and everyone starts seeing more "attacks" hitting their PC's. It would be helpful, as I'll Try said, to know what these attack messages are saying. Let us know if any of them are in your subnet range. I don't recommend you tell us what your IP is or which one's (if any) are in your range. There may be malicious eyes viewing this stuff...

One more thing... can't you turn off the alerts in whichever program(s) are alerting you? I mean, you can check the log file manually every once in a while to see what's going on. It's not like you have to know when someone's pinging or scanning your IP...

As long as norton is blocking the attacks you are fine....I think in norton there is an option to stop showing every alert window...you are still protected..just dont see popups about it every 3 seconds. If I was to view every "blocked incomming" alert I would be doing nothing but hitting ok on the popups. About 98% of my recorded logs are from pings which is the basic tool we all have on our pc to see if another pc is "alive" If you have norton to stealth your ports...your computer shouldn't answer the ping request, therefore anyone trying to ping your computer sees nothing in return. If you had no firewall the "pinger" would see your computer as "alive" and could then try different ports and use known windows exploits to carry out furthur actions. To see if all is well with your security setup you could try Grc's shields up scans PC flanks scans Nortons scans If all is well you should show stealth on all ports scanned. If not...they have recommendations for how to fix whatever is wrong. Supressing the alert boxes as said above won't stop popup alerts for outgoing requests because norton needs your permission to allow or not allow whatever program thinks it needs internet access or server rights.

Thank You for your responses. I guess I should of made myself more clear on my initial question. How I find out that I am receiving these attacks are from the Norton Firewall logo in my system tray blinking a red exclamation mark over the logo. I should of also said that I am using pop-up stopper and it too is located in the system tray (I know that Norton Firewall 2003 has a pop-up program already installed, but sometimes my pop-up stopper stops pages that Norton doesn't catch). To continue... When I see that I am being attacked I will click on the Norton Firewall icon in the system tray and it will bring up the number of the attacker. By clicking on that number it takes me to the detailed map of where the attacker is from. I then open up my Firewall and click on intrusion detection and then to the configure button. From here I can add the address (number) to my blocked lists. This is what I have done for every attack. Am I doing this wrong? I have around 45 attacks within the restricted zones from yesterday. If this is usual "common" thing that happens then I feel lucky using the internet and not receiving attacks over the past three years with Norton Firewall.