Incoming Events Not Being Logged

[dbenjaminod]

Well I hoped I'd not be posting a problem again, however it seems another has popped up, I'll summarize what has happened and the problem.

The other day on Wednesday I was checking over McAfee when I noticed that the list of incoming events was somewhat lacking compared to the usual bombardment and now it seems that nothing is being logged at all.  According to the Virtual Technician my copy of McAfee is fully operational and has no problems but this issue with the log is rather frustrating.  I know from reading here that the incoming log is a list of attempts/connections that have failed.  I'm bothered about the fact that I cannot see these and know that they are being blocked.

The firewall is up, it says my computer is secured and no action is required.  I attempted a system restore back to the start of this week and that appears to have done nothing, in fact the issue seemed to get worse with hardly anything being logged in the incoming events.  After that did not work I got onto the Technical Support Chat and one of the techs inspected my McAfee and told me the program was fully operational and fine but he recommended that I reinstall McAfee and sent me the info I needed to do so by email.  I removed everything and completed a new install last night.  However the problem still seems apparent and there is minimal activity in my incoming log when at one time I was constantly told that such and such was attempting a unsolicited connection.

I remember reading a thread here similar to this but it appears that the solution that helped them has not done the same for me, I am monitoring the log to check that it is now doing it's job since booting the computer up.

I would like to add that most other things are working perfectly fine, the realtime scanner is blocking and deleting tracking cookies and has done in the last 10 minutes and most other things appear to be showing, it's only the log that seems to be problematic.

This past week there have been two updates both for McAfee and for Windows (I believe in the form of a Security Update) which after reading a previous thread does seem to be a likely culprit for this problem but I am rather stuck now and was hoping I was not the only person in the world who has had this issue.  It's a comfort knowing my firewall is blocking things so if I can be helped to resolve this issue, I would be most grateful.

So does anyone know/has anyone else experienced issues with their firewall log?

[theflyingmonkey]

The only advice I can give you is that sometimes the logs will log activities such as going to google and stuff and sometime it doesn't.  I had a online chat with support and I was redirected 3 times to their supervisor, when I asked why it logs it sometime and other times it doesn't.

The answer they gave me wasn't really an anwer as to why today I will get activity logged with google's ip and then tomorrow I don't.  The only thing they kept telling me was that as long as the firewall was on and set correct it is blocking any incoming connections that are being used by your programs in the Internet Connection Programs list.

[dbenjaminod]

Yeah your situation does sound similar to mine, it has been logging things down but it's rather selective as to when.  I've had a few instances where I've left the computer idle and then surfed and I then get a list of like 7-10 attempted connections all at the same time (I assumed these happened across the time I was idle but were updated all at once).  As mentioned it does appear to be logging things and it clearly states that my firewall is on and even MVT tells me that everything is perfectly fine. 

I had the same sort of thing with tech support, I don't really get a conclusive answer as to why it was happening and was just told to reinstall.

Reinstalling McAfee did not seem to correct the problem, it does much the same as before and it's been like a week now and the computer hasn't looked slower or any different in terms of performance so one would assume the firewall is actually doing it's job.  The tech I chatted to before installing looked at McAfee on my computer and told me everything was working fine and I'm getting the same thing now too with everything being "secure".  It seemed to happen after the updates this past week, there was one for xp sp3 and McAfee that required me to restart (if I remember correctly).  I'm going to see how it goes and later may try and uninstall things like Malwarebytes and Ad-aware and see if that changes anything.

If nessesary I may even try reinstalling mcafee without MWB and AA on the computer and see what that does.  I presume by the lack of responses that this is something I should not worry to much about, what with mcafee telling me it's secure, the firewall is on and that MVT is also telling me my McAfee software is running with no issues?

[theflyingmonkey]

The only thing I can tell you is that the McAfee tech guy said that this is normal and I shouldn't worry about it as this is what it does and said that he couldn't tell me why because he isn't the Firewall team that made the firewall.

The interesting thing was that he told me all of the events being logged were blocked and stuff, so at this point I really stopped caring too much.  But for some reason, the activities I am getting on my logs are coming from google's ip address whenever I go to google.  The latest one which has me worried is that the ip address 74.125.239.11 accessing TCP Port 1777.  Upon research it showed that this port and some other ports that google was trying to access (recently) were used by trojans and worms before.

So whether this activity was blocked or not, I don't personally know as the tech said it was.  But I did do something before which was to download bittorrent and tried to run it with the port it is suppose to use as 50000.  The logs showed 5 ip addresses, which were the ones that I was downloading from and they were downloading from me.  This makes you wondered, if the activity in the incoming events logs means that the attempts are blocked.  Then how is it that those ip addresses were listed in the logs accessing TCP Port 50000, yet they were able to download from me?

I asked the tech and they couldn't give me an answer why it is listed, when they say that the listed events are blocked.  But clearly if those ip addresses were blocked they wouldn't be able to download from me.  So I guess the only thing I can say is that sometimes there will be events and sometimes there aren't.  But recently, whenever I go to google I would get incoming events from them.  Not sure if it was the newest update to the Security Center and Firewall or not.

But I wouldn't uninstall Malwarebyteses as that doesn't affect McAfee at all, unless you are using the Pro edition which has the real-time scanning.  If you aren't using that then, I would say don't bother uninstalling Malwarebytes, since it probably wouldn't do a thing.

[dbenjaminod]

Okay I yesterday formatted my computer and reinstalled windows, it's fully updated and I have a copy of McAfee running with it telling me that McAfee is secure and protecting my computer.  However I still seem to have exactly the same issue with the firewall and it's apparent not wanting to log incoming connections.  McAfee tells me that it's on, all the settings appear to be at default as before yet there seems to be a lack of things in the logs.  It also sometimes does the same thing where I get a number of logged events all in the same minute sometimes from the same ip.

I must say I'm not overly happy about this, is it so wrong to be bothered about my computers security, I realize what the log is for, telling me that certain things are failing to connect to my computer but I would very much like the peace of mind and know what is trying to and when.  From what I can tell from the past week before reformatting (where it was much the same) everything appears to be alright, however this is just an irritance and how am I going to know when things are getting through? Is the firewall doing it's job still, despite the lack of logged events?

Things are appearing in the logs but I remember about 2 or 3 weeks ago and the months before I was being informed of a multitude of attempted connections, yet now there seem to be far less.  Is there something that has happened in the last update to cause this?  I can't believe that I'm the only person using XP sp3 who is having problems.

-I've tried reinstalling

-I've chatted to support and been informed before the format that everything was working fine.

-I've formatted my computer with windows now entirely fresh.

-If anyone can chime in with some wisdom I'd very much appreciate it.

[Hayton]

Open your Security Center and click on Firewall, then on Settings.

Under Security Levels, what setting is selected?

And under Firewall History, how many boxes are checked under "Log these events"?

[dbenjaminod]

Thanks,

Security Settings are the default/recommended "Outgoing Access - Give all my programs out-going access only"

Under Firewall History all those boxes are ticked, with "Log these events" and then all the individual ones also ticked. The "Don't Log Events on these ports" is unchecked and the bar greyed out.

[Peacekeeper]

Does selecting monitored access change things? I prefer this setting.

[dbenjaminod]

Not that I've noticed, there was two attempts before I changed the setting about half an hour ago, the last lot were when I was surfing an hour beforehand.  Besides that theres not been any at all the past 30 minutes.  Should I be bothered by this?  It's acted like this the past 2 weeks or so and I've not really noticed anything abnormal.  I just find it bizarre that there are not as many logged connections as there were before.

edit: It just logged two attempts a second ago, I have a feeling it would have done that regardless of what setting the Firewall was set up as.

Message was edited by: dbenjaminod on 19/11/11 14:45:27 CST

[Peacekeeper]

Please monitor it and post back Monday morning so I can add this to our phone call Monday arvo