firewall confusion

until recently I have been using black ice ip as my firewall, which used to sit in my sys tray and flash at me when i was attacked by this ip addy for so and so reason etc, I am now trying armor2net which seems more geared towards what my computer is doing, this program is trying to access the internet etc, do i need to reinstall black ice for intrusion detection
or is one firewall enough?

 

You don't want 2 firewalls installed at the same time - could cause serious problems.

Black Ice (at least older versions) has always been more geared at blocking outside intrusion.

Most modern firewalls now warn you of programs trying to access the internet from your computer. The concern is trojan viruses that get into your system via email or some other way, and then open a back door into your system and "phone home" to let some hacker know that your system is open.

 

Nuff said.

 

Shouldn't my A.V be blocking trojans? and what about intrusion attempts is my armour2net blocking them or should I be using something else?

 

Get a router that acts like a second firewall naturally.

 

Any modern firewall software will probably be adequate. The real important thing is that it STEALTH your ports, that way hackers can't even see your computer. To find out if your ports are stealthed, go here: https://grc.com/x/ne.dll?bh0bkyd2

If you're using dialup then you don't really need a firewall - your IP changes everytime you connect and you'll never be connected long enough to allow someone to scan, then come back and hack your ports.

If you're on broadband then, as the previous poster indicated, since they're so cheap anyway you might want to install a router (especially if you're sharing your Internet between moe than one computer). A router will isolate your computer (or network) from the internet. Some modern routers even have a built-in firewall on top of that.

Yes your anti-virus program should prevent a Trojan or worm from infecting your system, but keep in mind that when a new virus is released there's a window before the definition for it is released by your AV program's publisher that you could be infected. Small chance, but still possible. SOMEONE has to get infected first. A firewall can act as a secondary warning system.

Another reason is that some programs that are NOT viruses also phone home for nefarious and annoying reasons. These include spyware and registration programs.

 

I would only run one software firewall, I use Kerio myself, plus I use a Linksys Router as well to protect my network. A software firewall is used to control outbound traffic, as said above it will catch Trojans, Spyware, mail ware, anything trying to access the internet.

Alot of new Trojans, attack anti-virus programs, and software Firewalls and disable them an example would be Backdoor.OptixPro.10.c, this Trojan is nasty.

Scan all files before you open them, even then sometimes the AVP will miss them because of how they are packed, or they are new and the AVP doesn't detect them. Kerio allows one to add a password to it, so it's hard to bring this firewall down, but it is software so it could be brought down.

Just keep all of your security software up to date, I also use Trojan hunter, which is a dedicated Trojan scanner, that detects Trojans that my AVP misses.