Re: help with SyGate needed

From: Jarmo P (a_at_nospam.b.invalid)
Date: 01/30/04 

Date: Fri, 30 Jan 2004 19:38:47 +0200

"> Question 1: Once installed, do I have to leave the Sygate window
> opened to have the firewall be 'on'?
>
> Question 2:
> After I installed Sygate and the computer restarted, the registration
> window opened up and so I connected the PC to internet to do the
> registration. Right after that, a message window popped up asking me
> whether I want to say "yes" or "No" to this: "An application named
> NDIS User mode I/O Driver (file name ndisuio.sys) is trying to access
> Internet."
>
 A few things.

1. You dont have to keep the firewall main window on, there is the SPF icon
on the bottom right in the systray, showing traffic. Right clicking it you
get all the options you need.

2. You need to answer yes or no, and for many programs also maybe tell it to
remember.
With ndisuio.sys, you can block it, if you dont have any wireless things
running, main thing is you must set it to remember. That way no more popup
warnings. Allow or Block, not asking.

Sygate firewall definately needs to disable 'Act as Server' option for
Generic Host for Win ... = svchost.exe. It is a security risk !!!

You should do it also to many other programs that popup, except messengers
and other server rights needing programs that you need for those things.
Safe is to disable that for all.
Thing is, SPF gives them server rights by default, so you have to go and
disable them all afterwards. Manually like i tell you below for svchost:

How to disable svchost.exe act as server:
1. Go to SPF main window, uncheck "Hide Windows Services"
2. Click Applications button, and select from the window list: Generic Host
..."
3. Click Advanced buttom from the bottom left, and uncheck from the new
window "Act as Server"

Sygate allows too much, it is a fine firewall, but for a newbie needs some
configuration.

About them trojan warnings, if you have open ports, the scan tells you about
them, but no need to worry, they are propably just possible exploits, not
meaning you have any. The site should have the explanation changed.

Quantcast