Remote Access Shield blocking new laptop

[James Blonde]

I bought a new laptop a couple of weeks agin and have been having real problems accessing shares or remote desktop on 1 particular Windows 10 desktop PC on my network.

I have 2 Windows 10 Pro desktop PCs, a (new) Windows 10 Pro laptop and a QNAP NAS.  All on latest updates.

I'm using Avast Premium Security on all my Windows devices. 

All Windows devices are on a Private network in the firewall (double and triple checked)

The laptop came with Windows 10 home, which I upgraded by upgrading the license to Win 10 pro and doing a system update, however problem existed on Windows 10 home as well.  Originally, I couldn't access ANY fileshares or remote desktop to any network devices from the laptop - Windows Error Code 0x80070035. 

Working off that error code, I used this video to get access to one PC and the NAS:  https://www.youtube.com/watch?v=YG3iND6Ts6k&ab_channel=Britec09 - I think it was the local security policy change that might have resolved the NAS issue. 

However I still couldn't access 1 PC and continued to get that Windows Error Code. 

Last night, I started looking at Avast on the PC that I couldn't access when I realised I was having problems accessing shares / remote desktop from my other PC as well.  My Remote Access Shield was showing the laptops internal IPv6 IP address as being blocked.  In Remote Access Shield settings, "Block all connections except the following" was ticked, and 1 internal IPv4 address was added - not the laptops.  (not sure what it was).  I unticked the "Block all connections" checkbox, and could then access the PC from the laptop.

I've been able to access the PC from the laptop most of this afternoon (I'm doing lots of file transfers between my 3 windows devices and also to my NAS after upgrading hard drives)

However tonight I'm again unable to access the PC from the laptop.  I'm receiving "Incoming Connection Blocked - we've safely blocked an attempt to connect to your computer using File and Print Sharing"

Threat Name - SMB:BruteForce
Attacker IP - laptop's IPv6 address
Process - System
Detected by - Remote Access Shield
Status - Connection Blocked

I've tried:

Blocking all connections and adding both the IP4 and IP6 addresses of my laptop as trusted in Remote Access Shield
Turning off Remote Access Shield
Turning off Firewall

none of those worked. 

Have restarted the PC, and now seem to have access again.  I'm actually annoyed that the restart worked, almost negates me making this post, but I'm going to leave it up - it may happen again, especially given how long the problems have been going on! 

Anyone got any ideas???  This is driving me nuts

Thanks

[Jakub Dubovic]

Hello James,

The brute-force attack warning is triggered when a device (in this case the laptop) tries to connect to the SMB port of the host (the PC getting the "Incoming Connection Blocked" messages) unsuccessfully multiple times in a row. Avast blocks further connection attempts from the device as these could be sent by an attacker trying to guess your password.

You already know that the laptop is sending the connection attempts with invalid credentials. This could either be a false positive (e.g., legitimate software that tries to access shared files, but is not configured properly) or malicious software trying to gain access to other devices on the network (more information here: https://support.avast.com/en-eu/article/Antivirus-Remote-Access-Shield-FAQ).

I would advise you to scan the laptop for malware (if you haven't already done so). In case the brute-force attack warnings are false positives, you could try to find out which software is attempting the connections and either provide it with correct credentials, or disable it.

If you have any questions, please let me know.

Jakub

[James Blonde]

Thanks Jakub,

 I *think* they're false positives, as they coincided with me trying to connect to the PC using windows explorer usually.  I've scanned the laptop and everything is fine.

Credentials - that's an interesting point....  Given I'm logging on to all 3 Windows devices using my Microsoft account, I'd have thought the credentials would have been shared - they seemed to be between the 2 PCs anyway (and with my old laptop before it broke).  This laptop just seems to have had issues connecting from the start and I'm having to do lots of digging around to fix them. 

(The NAS is also new and my first NAS - I used to use one of the Windows PCs as the server, and wasn't expecting the NAS to be much more complex, but it does feel like I've bitten off more than I can chew with the NAS - I'm not as technical as I once was, and it's showing! )

[ross89]

Hi Jakub.

I have recently upgraded my Avast and am now getting the 'File and Print Sharing' blocked message when I open my Sonos controller, the detail is suggesting the threat is actually coming from one of my Sonos 3 speakers or at least that's the IP address being reported. Do you have any idea how I can get around the problem because it has effectively killed my Sonos system which now cannot read from my external drive, Sonos simply reports the folder is not shared when it most certainly is.

Hope you can help.

Ross

[ross89]

Hi Jakub.

Sorry I might have given some incorrect info in my first post.

The problem cannot be with the Remote Access Shield as it is not installed however something is blocking access to the file share as I keep getting the pop-up notification when the Sonos controller is both first opened and also when it is left open, it's almost as though it periodically tries to access sharing and is blocked each time. Every time the IP address is shown as the Sonos 3 speaker.

Hope that is more clear.

Ross