Deny Internet access for running process

[JitzyJT 1]

Hello ESET,

 

I would like to know how to deny internet access for a particular running process using eset firewall. 

I also would like to know how to deny internet access for a particular Microsoft Store app. The path leading to "C:\Program Files\WindowsApps" doesn't give permission to manually add them.

Instead is it possible for firewall to block it from the running process?

 

For example below is a screenshot of a store app running in the memory "Disney Magic Kingdoms" and the process name is "_dk_entrypoint_precompiled.exe". Now I can't block it the traditional way since the user have no access to the folder ("C:\Program Files\WindowsApps\DisneyMagicKingdoms") by default.

So I want to know if I can block that process running in memory using eset firewall?

Windows default firewall could do it.

Edited August 5, 2020 by JitzyJT

[Marcos 5,074]

Via the network connections panel you can temporarily block communication for a process:

 

Quote

Now I can't block it the traditional way since the user have no access to the folder ("C:\Program Files\WindowsApps\DisneyMagicKingdoms") by default.

I don't understand. Only users with administrator rights can create rules. And such users have access to folders in Program files.

[JitzyJT 1]

45 minutes ago, Marcos said:

Via the network connections panel you can temporarily block communication for a process:

Is that the only way to block internet connection for running processes?

Because when that process starts again it can access internet unless I do what you mentioned. I want to know if I can deny internet access for a process permanently.

 

 

49 minutes ago, Marcos said:

I don't understand. Only users with administrator rights can create rules. And such users have access to folders in Program files.

I'm the admin of my Windows account and I have admin rights and I can access any folders inside "Program Files" except for "Windows Apps" folder.

 

 

[peteyt 393]

3 minutes ago, JitzyJT said:

Is that the only way to block internet connection for running processes?

Because when that process starts again it can access internet unless I do what you mentioned. I want to know if I can deny internet access for a process permanently.

 

 

I'm the admin of my Windows account and I have admin rights and I can access any folders inside "Program Files" except for "Windows Apps" folder.

 

 

Do you use the apps? If not rather than just blocking it does it not let you uninstall them?

You can block most normal apps but I believe Windows store apps are different although I could be wrong. Part of the problem is they sometimes create new folders for each version.

It also looks like a permission issue stopping you from accessing the folder but unsure why. Does the security tab link in the message do anything?

[Marcos 5,074]

You can create a blocking firewall rule for specific applications. As for WindowsApps, not sure what's special about it since I can't get there either from explorer after elevating rights via UAC but can get there through a file manager after elevation.

[JitzyJT 1]

12 minutes ago, peteyt said:

Do you use the apps? If not rather than just blocking it does it not let you uninstall them?

Thank you @peteyt

Yes I do use uwp apps and yes it will let me uninstall them. I use normal Windows "Apps & Features" setting to uninstall most of the apps. Some Windows own apps cannot be uninstalled like that. For that I use powershell commands. It's not a problem though.
 

 

12 minutes ago, peteyt said:

It also looks like a permission issue stopping you from accessing the folder but unsure why. Does the security tab link in the message do anything?

It's indeed a permission issue. I can access the folder through another app called Minitool Partition Wizard. But I get the "Access Denied" popup if I try to open the folder directly by going through my C drive or browse it through ESET.
 

Edited August 5, 2020 by JitzyJT

[peteyt 393]

3 minutes ago, JitzyJT said:

Thank you @peteyt

Yes I do use uwp apps and yes it will let me uninstall them. I use normal Windows "Apps & Features" setting to uninstall most of the apps. Some Windows own apps cannot be uninstalled like that. For that I use powershell commands. It's not a problem though.
 

 

It's indeed a permission issue. I can access the folder through another app called Minitool Partition Wizard. But I get the "Access Denied" popup if I try to open the folder directly by going through my C drive or browse it through ESET.
 

Found this not sure if its any good but apparently has methods https://www.maketecheasier.com/access-windowsapps-folder-windows-10/

[JitzyJT 1]

7 minutes ago, Marcos said:

You can create a blocking firewall rule for specific applications. As for WindowsApps, not sure what's special about it since I can't get there either from explorer after elevating rights via UAC but can get there through a file manager after elevation.

Exactly @Marcos

If i use a file manager or some space explorer apps I can access the folder and it's contents but not possible through explorer or from ESET.

That's why I asked about denying access through the running process tab. But I need a permanent way to deny access for it

[Marcos 5,074]

As a workaround you could temporarily switch to interactive mode, run the desired Windows app, create a blocking rule and then switch back to automatic mode. However, creating rules for Windows apps is not recommended since the folder name changes with each update of the app and therefore you'd have to create a new rule each time an app updates.

[JitzyJT 1]

Before ESET I have used Bitdefender, Kaspersky and Comodo. None of these apps could access the folder through explorer just like eset.

BUT all these security solutions had an option to  deny internet access "permanently" for a running process through their firewall module. 

I'm wondering if eset could do it as well. The workaround through network connections is only temporary

Edited August 5, 2020 by JitzyJT

[JitzyJT 1]

3 minutes ago, Marcos said:

As a workaround you could temporarily switch to interactive mode, run the desired Windows app, create a blocking rule and then switch back to automatic mode. However, creating rules for Windows apps is not recommended since the folder name changes with each update of the app and therefore you'd have to create a new rule each time an app updates.

Thank you @Marcos

I'll try that. I do know after each update the apps folder name changes and I have to do it again. 

[peteyt 393]

Just now, JitzyJT said:

Thank you @Marcos

I'll try that. I do know after each update the apps folder name changes and I have to do it again. 

Id also check that link above which might allow you to get proper access to the folder.

There's even a quick fix download but I'd use that one at your own risk

[JitzyJT 1]

6 minutes ago, peteyt said:

Id also check that link above which might allow you to get proper access to the folder.

There's even a quick fix download but I'd use that one at your own risk

I'll check it out. 

Thanks @peteyt

[JitzyJT 1]

24 minutes ago, peteyt said:

Found this not sure if its any good but apparently has methods https://www.maketecheasier.com/access-windowsapps-folder-windows-10/

Thank you @peteyt

I followed the "Manual" instructions in that page and took ownership of the folder and it's contents.

Now I can access it through ESET firewall to create rules.Don't even have to change to interactive mode in the firewall module.

 

It works!!!

Now I want to know if there is any security concern for taking ownership of the "Windows Apps" folder andit's contents since Windows didn't want to allow access by default.

[JitzyJT 1]

But I would really appreciate if ESET have a feature in their firewall module to deny access to running processes on user demand "permanently"

[peteyt 393]

3 hours ago, JitzyJT said:

Thank you @peteyt

I followed the "Manual" instructions in that page and took ownership of the folder and it's contents.

Now I can access it through ESET firewall to create rules.Don't even have to change to interactive mode in the firewall module.

 

It works!!!

Now I want to know if there is any security concern for taking ownership of the "Windows Apps" folder andit's contents since Windows didn't want to allow access by default.

Can't help you with that one sorry. A bit weird that it would be blocked. Could just be extra security 

The only thing is if the folder changes it may need re blocked as some apps have the version numbers as the folder e.g. app version 1.1 so when the version gets updated its now in folder 1.2 and eset was set to block or allow 1.1 

[itman 1,659]

3 hours ago, JitzyJT said:

Now I want to know if there is any security concern for taking ownership of the "Windows Apps" folder andit's contents since Windows didn't want to allow access by default.

The problem here initially is the Eset GUI was being denied access to the Windows Apps folder when you tried to select a file in that folder.

The solution to this and like access situations is to first copy/create the full path name to the desired .exe and paste it into the Eset firewall rule. This eliminates the Eset GUI permissions issue since the GUI is not trying to physically access the folder.

Make sure you reset Windows Apps folder back to its original default permissions.

Edited August 5, 2020 by itman

[JitzyJT 1]

42 minutes ago, itman said:

The problem here initially is the Eset GUI was being denied access to the Windows Apps folder when you tried to select a file in that folder.

The solution to this and like access situations is to first copy/create the full path name to the desired .exe and paste it into the Eset firewall rule. This eliminates the Eset GUI permissions issue since the GUI is not trying to physically access the folder.

Make sure you reset Windows Apps folder back to its original default permissions.

Thank you @itman for all your valuable inputs you share in this forum.

I did exactly what you mentioned and reverted everything back to default and the rule still works until the app gets updated. But now I know I can access the folder using a file manager and then copy the path name and then paste it on the Eset firewall module "Rules" tab.



Thanks for telling me that. I wonder why I didn't think about that in the first place!!!!

Now I don't have to change the permissions of Windows Apps folder every time the desired uwp app gets updated. 

 

@Marcos You can close this thread as I have the solution now. 

 

 

[peteyt 393]

9 hours ago, itman said:

The problem here initially is the Eset GUI was being denied access to the Windows Apps folder when you tried to select a file in that folder.

The solution to this and like access situations is to first copy/create the full path name to the desired .exe and paste it into the Eset firewall rule. This eliminates the Eset GUI permissions issue since the GUI is not trying to physically access the folder.

Make sure you reset Windows Apps folder back to its original default permissions.

What are the actual risks of changing the permissions and the reason it isn't accessible?

I mean I could understand if the system folder was like this by default for safety but the windows app folder is confusing considering the main windows program folder is accessible 

[itman 1,659]

12 hours ago, peteyt said:

What are the actual risks of changing the permissions and the reason it isn't accessible?

Quote

Windowsapps folder is where all the Modern apps data is stored. If you install any apps from the Windows Store is also stored in the same location. This folder is not provided full permissions so that if anything wrong happens by mistake, you might face issues with the modern apps.

https://answers.microsoft.com/en-us/windows/forum/windows_rt-files/what-is-cprogram-fileswindows-apps-hidden-folder/783b5a18-c44d-46f7-b638-e98054b7c2a8

[peteyt 393]

2 hours ago, itman said:

https://answers.microsoft.com/en-us/windows/forum/windows_rt-files/what-is-cprogram-fileswindows-apps-hidden-folder/783b5a18-c44d-46f7-b638-e98054b7c2a8

It's very generic though. I mean why not block access to the main windows program folder in that case in case anything goes wrong or am I missing something 

[itman 1,659]

4 hours ago, peteyt said:

I mean why not block access to the main windows program folder in that case in case anything goes wrong or am I missing something 

You really have to ask Microsoft "the rhyme an reasoning" behind this. My best guess is to make it difficult for malware to drop a bogus Store app there.