AgentWB 0 Posted May 31, 2016 Posted May 31, 2016 Hello. When I go into: Setup -> Network Protection -> Trouble Shooting Wiard. I get following blocked IPS/Services: C:\Windows\System32\svchost.exe - 166 attempts from various different IPs Unknown device: 91.228.166.16 - 138 attempts Unknown device: 137.135.12.16 Should I just let it keep blocking these IPs? Also the svchost.exe?
Administrators Marcos 5,466 Posted May 31, 2016 Administrators Posted May 31, 2016 The Firewall troubleshooting wizard should only be run if you experience network communication issues with firewall enabled. Unless you experience a particular issue, I'd suggest ignoring that information.
AgentWB 0 Posted May 31, 2016 Author Posted May 31, 2016 The Firewall troubleshooting wizard should only be run if you experience network communication issues with firewall enabled. Unless you experience a particular issue, I'd suggest ignoring that information. Well. I clicked network protection to set up a rule for a POSTgreSQL database, and I just noticed that the Troubleshooting Wizard had blocked various IPs. There is nothing in the Black List folder just the Troubleshooting wizard. I assume the Wizard is running byitself, cause I never turned it on.
AgentWB 0 Posted May 31, 2016 Author Posted May 31, 2016 The Firewall troubleshooting wizard should only be run if you experience network communication issues with firewall enabled. Unless you experience a particular issue, I'd suggest ignoring that information. So as I posted above. It shouldnt run by itself? Cause it did that and blocked those IPs without me doing anything.
itman 1,807 Posted May 31, 2016 Posted May 31, 2016 I would listen to Marcos and ignore what is posted Trouble Shooting Wizard unless you have having Internet connection issues with one or more applications. For example, IP address 91.228.166.16 is associated with Eset. The blocked activity noted probably occurred because of a network "glich" during Eset update processing. Things like this happen on occasion and is perfectly normal. Now if there are persistent and repeated failed Eset update issues, then the problem needs to be investigated.
Administrators Marcos 5,466 Posted May 31, 2016 Administrators Posted May 31, 2016 It might be worth checking a log with the blocked communication logged. To create one, continue as follows: - enable diagnostic logging under Tools -> Log files -> Minimum logging verbosity - enable advanced firewall logging under Tools -> Diagnostics - clear the firewall log - restart the computer - reproduce the "issue" - stop logging and switch back to standard logging verbosity - compress the log C:\ProgramData\ESET\ESET Smart Security\Diagnostics\EpfwLog.pcapng log and send it to me via a pm, if not too large.
AgentWB 0 Posted May 31, 2016 Author Posted May 31, 2016 It might be worth checking a log with the blocked communication logged. To create one, continue as follows: - enable diagnostic logging under Tools -> Log files -> Minimum logging verbosity - enable advanced firewall logging under Tools -> Diagnostics - clear the firewall log - restart the computer - reproduce the "issue" - stop logging and switch back to standard logging verbosity - compress the log C:\ProgramData\ESET\ESET Smart Security\Diagnostics\EpfwLog.pcapng log and send it to me via a pm, if not too large. I also get this: ESET Service - ESET, spol, s r o. C:\Program Files\ESET\ESET Smart Security\ekrn.exe Remote Adress: 192.168.0.01 - Destination Port: 59999 Protocol UDP Direction: In Should I just press allow? It says under Reputation: Green checkmark + an icon of alot of people.
Recommended Posts