Help for National customers

How to submit a firewall log

If your firewall reports any activity that you wish to have investigated we will require the following details:

The unedited firewall log

Many of the abuse reports we receive are incomplete or are missing crucial information that leads to a delay in our investigation of a case.

In this section you will find advice on what information we need to begin an investigation and why it is important that we are sent this information.<.p>

Many people edit the log that they submit to our department and in doing so omit crucial information. In contrast, many will send us a log consisting of thousands of lines when in fact they wish to report only one log entry to us.

If you wish to submit the log to us please send us the portion of the log that is relevant to the incident that you wish to report. Do not edit the portion of the log that you wish to report - if possible, include about half a day's log on either side of the incident so that we can build up an accurate picture of the incident.

System clock accuracy

Even if you have made reports to us in the past, we will always require any report made to us to include a confirmation of the system clocks accuracy and of the time zone it is in.

You can check your system clock by double clicking the clock in the bottom-right corner of your Windows desktop. You can also:

• Click the Start button
• Select Control Panel
• Open Date and Time
• Check and adjust your settings

While we understand that it can be inconvenient to include the confirmation with each report you make (especially if you have made reports to us in the past), we will still require you to include this confirmation.

Your firewall will record incidents against a time stamp that is recorded using your system clock. If your system clock is inaccurate (set to the wrong time and/or time zone) and you submit your firewall log to us, any investigation we launch based on the data contained in your logs may be compromised by the inaccuracy of the time stamp.

Make a report to the Virgin Media Security team

Where to find your firewall log

Windows Firewall:

Windows XP

First you will need to confirm whether XP has been logging your firewall activity.

1. Click Start, click Run, type firewall.cpl, and then click OK.
2. In the Security Logging section click Settings
3. Ensure Log dropped packets is ticked
4. Under Log File Options Note the name and location of the log file

If Windows has been logging your firewall’s activity you can navigate to the log file and view entries it as made.

Windows 7/Vista

1. Click the Start menu button and open the Control Panel
2. Search for ‘firewall’ in the search bar at the top right of the window, then select Windows Firewall from the results
3. Select Advanced Settings on the left
4. In the navigation pane, click Monitoring
5. In the Details pane, under Logging Settings, click the file path next to File name - the log opens in Notepad

ZONEALARM:

The log produced by Zonealarm is a plain text file. It can usually be found in the following location: C:\Windows\Internet Logs\ZAlog.txt

BLACKICE DEFENDER:

We are often sent enc files by individuals wishing to report network abuse. Please note that if you wish to submit a report regarding a Blackice log do not send us an enc file. The log file that we require is called attack-list.csv. It can usually be found in the following location: C:\Program Files\Network ICE\BlackICE\attack-list.csv

MCAFEE PERSONAL FIREWALL:

The log file for the McAfee Personal Firewall will have a .log extension to the file. You can find the log for McAfee Personal Firewall in the following location: C:\Program Files\McAfee\McAfee Personal Firewall\Log\*.log

SYGATE PERSONAL FIREWALL:

In order to extract the log you must tell your firewall to save the log to a file. Please follow these instructions to save a log for the Sygate Personal Firewall Product. - Click "Tools". Click "Logs".

1. Click "Security Log".
2. Click "File".
3. Click "Export".
4. Enter a name for the log file, select the folder in which you want to save the file, and then click "Save".

NORTON PERSONAL FIREWALL:

In order to extract the log you must tell your firewall to save the log to a file. Please follow these instructions to save a log for the Norton Personal Firewall Product.

• Open Norton Personal Firewall.
• Click Options.
• Click Internet Security (or Personal Firewall). This step is not always necessary.
• Click View Event Log. The different event logs appear as tabs.
• Click the Firewall tab.
• Click Log.
• Click Save Tab As.
• Enter a name for the log file, select the folder in which you want to save the file, and then click Save.

You may then open this log using notepad and extract the relevant section in order to submit a report to the abuse department.

Read about our Acceptable use policy.

Make a report to the Virgin Media Security team