Jump to content

What to do if we accidentally clicked “Allow” after ESET gives us a Network Threat Blocked notification?


Go to solution Solved by Marcos,

Recommended Posts

Okay, so context, I’m a University student and I use ESET for my laptop’s protection. I’ve been attending school for about a year now with ESET and ESET VPN to protect my laptop as I connect to my school’s Wi-Fi. Whenever I forget to turn on ESET VPN before I start browsing the internet or whatever, sometimes I get these yellow notifications that read “Network threat blocked.” I don’t know exactly where these “Network threats” come from. I asked a staff member from the IT department for an answer where these may potentially be coming from, he actually told me that he uses ESET too and often gets these notifications whenever he connects his personal laptop to the school’s Wi-Fi. He told me that “It’s probably another student. They’re always trying to hack the database or something to boost their grades or find answers to a test coming up, and we always have to track them down and report them to the campus or city police department.” Not sure why a student would be constantly be trying to hack a school, let alone another student’s computer. He assured me that it’s probably fine because literally everyone connects to the school Wi-Fi with their iPhones, Androids, Laptops, and not everyone uses ESET (Funny enough, I actually did catch a couple of student using Mcafee during my time here). Most of the time I just close the notifications, and I turn on VPN, however, a thought popped into my head and wondered “what should I even do if I did accidentally clicked the prompt that says ‘Change the handling of this threat’ and clicked ‘Allow’?” Not that I would ever do such a thing, but what should I do if I accidentally did do such a thing? Where do I go to remove/disallow/block the “threat” I just allowed? I’m mainly asking so I know what to do if I ever end up in this situation.

 

Sidenote: I don’t want to take screenshots of my desktop to catch these notifications, so I took screenshots off my iPhone through Google images so I can show what I’m talking about.

IMG_0811.png

IMG_0812.png

Link to comment
Share on other sites

To begin, your screen shots show you are using Eset Smart Security Premium which does not include a VPN. Eset Smart Security Ultimate is the only product that includes a VPN.

Link to comment
Share on other sites

34 minutes ago, itman said:

To begin, your screen shots show you are using Eset Smart Security Premium which does not include a VPN. Eset Smart Security Ultimate is the only product that includes a VPN.

Well, regardless of the subscription, because I used to own Smart Security Premium, but I still get these notifications on Ultimate, so what about the concern in question?

Link to comment
Share on other sites

Your first screen shot shows Eset blocking unsolicted inbound TCP network traffic; i.e. not in response to prior outbound TCP network traffic. If your router contained a stateful firewall, this type of traffic would be auto dropped by the router.

Your second screen shot shows attempted inbound TCP port scanning activity. Again, most router's contain an IDS firewall component which would drop this activity at the router.

In any case, Eset blocked the activity.

Link to comment
Share on other sites

10 minutes ago, itman said:

Your first screen shot shows Eset blocking unsolicted inbound TCP network traffic; i.e. not in response to prior outbound TCP network traffic. If your router contained a stateful firewall, this type of traffic would be auto dropped by the router.

Your second screen shot shows attempted inbound TCP port scanning activity. Again, most router's contain an IDS firewall component which would drop this activity at the router.

In any case, Eset blocked the activity.

What I’m trying to find out is what would happen if I accidentally say, clicked the option that says “Change the handling of this threat” and accidentally clicked for the connection to be allowed, what would I have to do if I somehow made that mistake? I know it sounds absurd, but I did at one point almost made that mistake (mainly because I was tired that day and didn’t know what I was doing). So I want to know, if I did accidentally allowed one of these mysterious connections, how can I reverse the mistake and block it instead?

Link to comment
Share on other sites

  • Administrators
  • Solution
2 hours ago, E The Protector said:

What I’m trying to find out is what would happen if I accidentally say, clicked the option that says “Change the handling of this threat” and accidentally clicked for the connection to be allowed

You can review your IDS exceptions in the Network access protection setup:

image.png

Link to comment
Share on other sites

3 hours ago, E The Protector said:

What I’m trying to find out is what would happen if I accidentally say, clicked the option that says “Change the handling of this threat” and accidentally clicked for the connection to be allowed, what would I have to do if I somehow made that mistake?

To begin, you're only going to get Eset firewall alerts if firewall filtering mode is set to Interactive mode. In this case, the alert will display an option to "Create rule and permanently remember." If you selected this option and the mouse clicked on the Allow tab, Eset will create a firewall rule for the activity; you will not alerted thereafter; and the network activity will be always allowed. If you did not select the option to "Create rule and permanently remember" and selected Allow tab, you will be alerted thereafter each time the triggering network activity occurs.

Refer to this: https://support.eset.com/en/kb2352-create-a-firewall-exclusion-using-interactive-mode-in-eset-windows-home-products for further details.

Edited by itman
Link to comment
Share on other sites

On 10/18/2024 at 1:37 PM, itman said:

To begin, you're only going to get Eset firewall alerts if firewall filtering mode is set to Interactive mode. In this case, the alert will display an option to "Create rule and permanently remember." If you selected this option and the mouse clicked on the Allow tab, Eset will create a firewall rule for the activity; you will not alerted thereafter; and the network activity will be always allowed. If you did not select the option to "Create rule and permanently remember" and selected Allow tab, you will be alerted thereafter each time the triggering network activity occurs.

Refer to this: https://support.eset.com/en/kb2352-create-a-firewall-exclusion-using-interactive-mode-in-eset-windows-home-products for further details.

I mean, even if I did that I can always remove or change the rule, right? Which if I can, I don’t understand why it’s called a, “permanent rule.”

Edited by E The Protector
Link to comment
Share on other sites

32 minutes ago, E The Protector said:

I mean, even if I did that I can always remove or change the rule, right?

Correct.

Link to comment
Share on other sites

9 hours ago, E The Protector said:

Cool. Just to make sure we are talking about the same thing though, you do mean this setting that I circled in red, right?

Correct.

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...