ESET: Blocked IPS (alot of attempts)?

[AgentWB 0]

Hello.

 

When I go into: Setup -> Network Protection -> Trouble Shooting Wiard.

 

I get following blocked IPS/Services:

 

C:\Windows\System32\svchost.exe - 166 attempts from various different IPs

 

Unknown device: 91.228.166.16 - 138 attempts

 

Unknown device: 137.135.12.16

 

 

Should I just let it keep blocking these IPs? Also the svchost.exe?

 

 

[Marcos 5,070]

The Firewall troubleshooting wizard should only be run if you experience network communication issues with firewall enabled. Unless you experience a particular issue, I'd suggest ignoring that information.

[AgentWB 0]

The Firewall troubleshooting wizard should only be run if you experience network communication issues with firewall enabled. Unless you experience a particular issue, I'd suggest ignoring that information.

 

Well. I clicked network protection to set up a rule for a POSTgreSQL database, and I just noticed that the Troubleshooting Wizard had blocked various IPs.

 

There is nothing in the Black List folder just the Troubleshooting wizard.

 

I assume the Wizard is running byitself, cause I never turned it on.

[AgentWB 0]

The Firewall troubleshooting wizard should only be run if you experience network communication issues with firewall enabled. Unless you experience a particular issue, I'd suggest ignoring that information.

 

So as I posted above. It shouldnt run by itself? Cause it did  that and blocked those IPs without me doing anything.

[itman 1,659]

I would listen to Marcos and ignore what is posted Trouble Shooting Wizard unless you have having Internet connection issues with one or more applications. 

 

For example, IP address 91.228.166.16 is associated with Eset. The blocked activity noted probably occurred because of a network "glich" during Eset update processing. Things like this happen on occasion and is perfectly normal. Now if there are persistent and repeated failed Eset update issues, then the problem needs to be investigated.  

[Marcos 5,070]

It might be worth checking a log with the blocked communication logged. To create one, continue as follows:

- enable diagnostic logging under Tools -> Log files -> Minimum logging verbosity

- enable advanced firewall logging under Tools -> Diagnostics

- clear the firewall log

- restart the computer

- reproduce the "issue"

- stop logging and switch back to standard logging verbosity

- compress the log C:\ProgramData\ESET\ESET Smart Security\Diagnostics\EpfwLog.pcapng log and send it to me via a pm, if not too large.

[AgentWB 0]

It might be worth checking a log with the blocked communication logged. To create one, continue as follows:

- enable diagnostic logging under Tools -> Log files -> Minimum logging verbosity

- enable advanced firewall logging under Tools -> Diagnostics

- clear the firewall log

- restart the computer

- reproduce the "issue"

- stop logging and switch back to standard logging verbosity

- compress the log C:\ProgramData\ESET\ESET Smart Security\Diagnostics\EpfwLog.pcapng log and send it to me via a pm, if not too large.

 

I also get this:

 

ESET Service - ESET, spol, s r o.

C:\Program Files\ESET\ESET Smart Security\ekrn.exe

 

Remote Adress: 192.168.0.01 - Destination Port: 59999 Protocol UDP Direction: In

 

Should I just press allow?

 

It says under Reputation: Green checkmark + an icon of alot of people.