Preventing intrusion attempts

Intrusion Prevention checks for suspected attacks against your computer and blocks communication from the computers that initiate the attacks.

More Information

About Intrusion Prevention

Turning on or turning off Intrusion Prevention notifications

Excluding specific network activity from being monitored

Turning on or turning off AutoBlock

Unblocking AutoBlocked computers

Permanently blocking a computer that has been blocked by AutoBlock


About Intrusion Prevention

Intrusion Prevention scans all the network traffic that enters and exits your computer and compares this information against a set of attack signatures. Attack signatures are arrangements of information that identify an attacker's attempt to exploit a known operating system or program vulnerability. Intrusion Prevention protects your computer against most common Internet attacks.

More Info about the attacks that Intrusion Prevention blocks

If the information matches an attack signature, Intrusion Prevention automatically discards the packet and severs the connection with the computer that sent the data. This action protects your computer from being affected in any way.

Intrusion Prevention relies on an extensive list of attack signatures to detect and block suspicious network activity. You should run LiveUpdate regularly to ensure that your list of attack signatures is up to date.

More Information

Allowing or blocking access to your computer

Obtaining updates by using LiveUpdate

Managing the Personal Firewall

About Intrusion Prevention options


Turning on or turning off Intrusion Prevention notifications

You can choose whether you want to receive notifications when Intrusion Prevention blocks suspected attacks. Whether or not you receive notifications, Intrusion Prevention activities are recorded in Security History. The Security History entries include information about the attacking computer and information about the attack.

To turn on or turn off Intrusion Prevention notifications

  1. At the top of the main window, click the Norton Internet Security tab.

  2. Open the Settings bar.

  3. Under Web Browsing, click Intrusion Prevention.

  4. Click Configure.

  5. In the Intrusion Prevention General Settings window, under Intrusion Prevention Notification, click On or Off.

  6. Click OK.

You can choose whether you want to receive notifications when Intrusion Prevention blocks suspected attacks based on a particular signature.

To turn on or turn off an individual Intrusion Prevention notification

  1. At the top of the main window, click the Norton Internet Security tab.

  2. Open the Settings bar.

  3. Under Web Browsing, click Intrusion Prevention.

  4. Click Configure.

  5. In the Intrusion Prevention General Settings window, under Signature Exclusions, click Exclusions.

  6. In the Signature Exclusions window, click an attack signature, and then click Properties.

  7. In the Signature Properties dialog box, check or uncheck Notify me when this signature is detected, and then click OK.

  8. In the Signature Exclusions window, click OK.

  9. In the Intrusion Prevention General Settings window, click OK.

More Information

About Intrusion Prevention

About Intrusion Prevention General Settings options


Excluding specific network activity from being monitored

In some cases, benign network activity may appear similar to an attack signature. If you receive repeated notifications about possible attacks, and you know that these notifications are being triggered by safe behavior, you can create an exclusion for the attack signature that matches the benign activity.

Each exclusion that you create leaves your computer vulnerable to attacks.

To exclude attack signatures from being monitored

  1. At the top of the main window, click the Norton Internet Security tab.

  2. Open the Settings bar.

  3. Under Web Browsing, click Intrusion Prevention.

  4. Click Configure.

  5. In the Intrusion Prevention General Settings window, under Signature Exclusions, click Exclusions.

  6. In the Signature Exclusions window, uncheck the attack signatures that you want to exclude.

  7. Click OK.

  8. In the Intrusion Prevention General Settings window, click OK.

If you have excluded attack signatures that you want to monitor again, you can include them in the list of active signatures.

To include attack signatures that were previously excluded

  1. At the top of the main window, click the Norton Internet Security tab.

  2. Open the Settings bar.

  3. Under Web Browsing, click Intrusion Prevention.

  4. Click Configure.

  5. In the Intrusion Prevention General Settings window, under Signature Exclusions, click Exclusions.

  6. In the Signature Exclusions window, check the attack signatures that you want to monitor.

  7. Click OK.

  8. In the Intrusion Prevention General Settings window, click OK.

More Information

About Intrusion Prevention

About Intrusion Prevention General Settings options


Turning on or turning off AutoBlock

When an attack is detected, the connection is automatically blocked to ensure that your computer is safe. If the attack comes from a computer that has previously tried to access your computer by using another attack signature, it can activate AutoBlock. AutoBlock blocks all traffic between your computer and the attacking computer for a set amount of time, even if the traffic does not match an attack signature.

AutoBlock stops traffic between your computer and a specific computer. If you want to stop all traffic to and from your computer, you can use Block Traffic.

If AutoBlock blocks a computer or computers that you need to access, you can turn off AutoBlock.

To turn on or turn off AutoBlock

  1. At the top of the main window, click the Norton Internet Security tab.

  2. Open the Settings bar.

  3. Under Web Browsing, click Intrusion Prevention.

  4. Click Configure.

  5. In the Internet Security and Firewall Options window, on the left side, click AutoBlock.

  6. In the Intrusion Prevention AutoBlock window, click On or Off.

  7. Click OK.

More Information

Stopping all network and Internet traffic

Excluding specific network activity from being monitored

About Intrusion Prevention

Unblocking AutoBlocked computers

Permanently blocking a computer that has been blocked by AutoBlock

About Intrusion Prevention AutoBlock options


Unblocking AutoBlocked computers

In some cases, AutoBlock may recognize normal activity as an attack. If you can't communicate with computers that you should be able to communicate with, they may be on the list of computers that are currently blocked by AutoBlock.

If a computer that you need to access appears on the list of blocked computers, you can unblock it. If you have changed your protection settings and want to reset your AutoBlock list, you can unblock all of the computers that are on the AutoBlock list at once.

To unblock AutoBlocked computers

  1. At the top of the main window, click the Norton Internet Security tab.

  2. Open the Settings bar.

  3. Under Web Browsing, click Intrusion Prevention.

  4. Click Configure.

  5. In the Internet Security and Firewall Options window, on the left side, click AutoBlock.

  6. In the Intrusion Prevention AutoBlock window, under Computers currently blocked by AutoBlock, do one of the following:

    • To unblock one computer, select its IP address, and then click Unblock.

    • To unblock all computers on the AutoBlock list, click Unblock All.

  7. Click OK.

More Information

Stopping all network and Internet traffic

Excluding specific network activity from being monitored

Turning on or turning off AutoBlock

Permanently blocking a computer that has been blocked by AutoBlock

About Intrusion Prevention AutoBlock options

About Intrusion Prevention


Permanently blocking a computer that has been blocked by AutoBlock

You can permanently block a computer that has been blocked by AutoBlock. The permanently blocked computer is removed from the AutoBlock list and added to the list of blocked computers that appears in the Personal Firewall Trust Control options window.

To permanently block a computer that has been blocked by AutoBlock

  1. At the top of the main window, click the Norton Internet Security tab.

  2. Open the Settings bar.

  3. Under Web Browsing, click Intrusion Prevention.

  4. Click Configure.

  5. In the Internet Security and Firewall Options window, on the left side, click AutoBlock.

  6. In the Intrusion Prevention AutoBlock window, under Computers currently blocked by AutoBlock, , click the computer that you want to block permanently.

  7. Click Restrict.

  8. Click OK.

More Information

Turning on or turning off AutoBlock

Unblocking AutoBlocked computers

About Personal Firewall Trust Control options

About Intrusion Prevention AutoBlock options

About Intrusion Prevention


Protection Alert

When you turn off Intrusion Prevention, your computer is not protected from Internet threats. If you cannot view certain online content, you should adjust individual security settings instead of turning off Intrusion Prevention.

If you must turn off Intrusion Prevention, you should turn it off temporarily to ensure that it will turn on again automatically.

To temporarily turn off Intrusion Prevention

  • In the drop-down list, select how long you want to turn off Intrusion Prevention, and then click OK.

To ensure that your computer remains protected, you can turn on Intrusion Prevention manually before the time that you specified concludes.


Signature properties

You can choose whether you want to receive notifications when Intrusion Prevention blocks suspected attacks based on a particular signature. The notifications include more information about the attacking computer and the attack.

To turn on or turn off an individual Intrusion Prevention alert

  • In the Signature Properties dialog box, check or uncheck Notify me when this signature is detected, and then click OK.