Kerio doing things against (its) nature

[jeeza]

I thought I was having a good idea downloading the Kerio firewall and trying it out, and still hope so, but it did some strange things which in a car would cause someone to say that it had a few failures.
Kerio is supposed to ask, whenever you try to run an application, or your computer is trying to run it, which wants to connect to the internet, for your permission to do so.
Kerio did this at first, probably so I got a good impression of it, but after a little while didn't bother to do so anymore.
On the other hand, my Firebird browser suddenly didn't connect to the internet anymore (this occurred several times when clicking on links in several websites).
A computer program is not supposed to do things on its own (maybe this should even be the first law of robotics, contrary to Isaac Asimov's idea), so I have my explanation ready : someone installed a trojan on this computer and is having a day with it...
Can someone tell me if there is a better explanation ?
I ran Hijack This so as to be prepared for any suggestion in this direction (I had reservations until now about using Hijack This because I didn't think it was a good idea generally to post the contents of your registry and such on the internet).

[Paul Komski]

(a) Did you or did you not at some point in time check the box to make the rule stick?

(b) What rules have been set in the Kerio Administration | Firewall | Advanced settings for Firebird and any other apps that you are concerned about?

[david eaton]

I had reservations until now about using Hijack This because I didn't think it was a good idea generally to post the contents of your registry and such on the internet

Well, if there is personally identifiable information there, then I would share your concern, but there is nothing in a Hijack this log which could identify the individual machine. It is possible to substitute xxxx for usernames etc, and I think there are a few webpages that give a user ID if set as Homepage (Ebay etc) Again, a judicious use of XXX will cure that, but if posting a log with those amendments, please say what items were amended!

Apart from that, it's better to be certain that nothing has crept under your defences!

[jeeza]

Originally posted by david eaton


Well, if there is personally identifiable information there, then I would share your concern, but there is nothing in a Hijack this log which could identify the individual machine. It is possible to substitute xxxx for usernames etc, and I think there are a few webpages that give a user ID if set as Homepage (Ebay etc) Again, a judicious use of XXX will cure that, but if posting a log with those amendments, please say what items were amended!

Apart from that, it's better to be certain that nothing has crept under your defences!
It's not even because of personally identifiable informtion, I was thinking more along the lines of giving possible hackers some clue useful to them. Or is this needlessly worrying too much for too little, if not nothing ?
I will certainly take your advice, And how I agree with your last statement!
But what do you mean with that eBay homepage ?

[david eaton]

If you have an ebay account, and set your homepage in IE to it, your customer ID is part of the link! There may be other, similar, sites. Now that could be useful to maliciously disposed persons.

As for giving information to hackers, I don't think that a log would help them any!

[jeeza]

Originally posted by Paul Komski
(a) Did you or did you not at some point in time check the box to make the rule stick?

(b) What rules have been set in the Kerio Administration | Firewall | Advanced settings for Firebird and any other apps that you are concerned about?
a) What box, which rule ?
b) In/out permits for Firebird of course. It's not other apps which are the problem, it's Kerio.
But I can tell you I used a website retrieving app (to retrieve a website, or at least part of it, if you really must know) which was just stopped from working by Kerio without asking anything and without having set a rule for this app.
In the meantime I uninstalled Kerio again because I was too bothered with it at the moment ; I will probably install it again.
You know, I am installing and using all kinds of apps quite frequently. Just these past few hours I installed two different chat programs, Hijack this and Entropy, and am quite sure that there was at least one app which connected to the Internet without any query from Kerio. Maybe it was even that website retrieving app (WinHTTrack) ; when you have been using that computer for hours and hours on end, sometimes you have some difficulty remembering it all clearly.