User Guide - Kaspersky Lab

Protection against network attacks 165
(MS05-011) Microsoft Windows SMB Client Transaction Response
Handling
(MS05-017) Microsoft Windows Message Queuing Buffer Overflow
Vulnerability
(MS05-039) Microsoft Windows Plug-and-Play Service Remote Overflow
(MS04-045) Microsoft Windows Internet Naming Service (WINS) Remote
Heap Overflow
(MS05-051) Microsoft Windows Distributed Transaction Coordinator
Memory Modification
In addition, there are isolated incidents of intrusion attacks using various
malicious scripts, including scripts processed by Microsoft Internet
Explorer and Helkern-type worms. The essence of this attack type
consists of sending a special type of UDP packets to a remote computer
that can execute malicious code.
Remember that, while connected to the network, your computer is at constant
risk of being attacked by a hacker. To ensure your computer's security, be sure
to enable Firewall when using the Internet and regularly update application
databases (see 17.3.2 on pg. 227).
12.3. Blocking and allowing network
activity
If the security level for the Firewall is set to Training Mode, a special notice
appears on screen each time a network connection is attempted that has no rule.
For example, after opening Microsoft Office Outlook, it downloads your email
from a remote Exchange server. To display your Inbox, the program connects to
the email server. Firewall always tracks this kind of network activity. A message
will appear on the screen (see Figure 58) containing:
• Description of activity – name of the application and a brief description of
the connection that it is initiating, generally including the connection type,
the local port from which it is being initiated, the remote port, and the
address being connected to. Left click anywhere in the area to obtain
detailed information on the connection, its initiating process, and the
application distributor.
• Action – series of operations that Firewall will perform regarding the
network activity detected.