AVG Support Community
Share tips and solutions on AVG Products
Community topics
AllAVG Gurus
These community experts are here to help
-
Alan Binch
-
Borislav Angelov
-
Vladimir Bartl
-
Subhadeep Kanungo
-
Miloslav Serba
Artur Bartosz Problem with LAN smb BruteForce
Hi,
We have few PCs in office.
All PCs are connected to the same LAN, Windows 8-10 and latest AVG Internet Seciuryty.
All PCs are scnned.
On one of PCs (192.168.1.200) AVG show warning that another PC in LAN (192.168.1.211) are trying to smb brute force attack - incoming remote desktop connection are blocked:
https://i.imgur.com/xA5K47Y.png
List of all tries:
https://i.imgur.com/8eea2HN.png
I check 192.168.1.211 and
- remote access and help turned off
- samba in windows features turned off
- no AVG warnings
Please AVG, could you help us?
Greetings,
Artur
We have few PCs in office.
All PCs are connected to the same LAN, Windows 8-10 and latest AVG Internet Seciuryty.
All PCs are scnned.
On one of PCs (192.168.1.200) AVG show warning that another PC in LAN (192.168.1.211) are trying to smb brute force attack - incoming remote desktop connection are blocked:
https://i.imgur.com/xA5K47Y.png
List of all tries:
https://i.imgur.com/8eea2HN.png
I check 192.168.1.211 and
- remote access and help turned off
- samba in windows features turned off
- no AVG warnings
Please AVG, could you help us?
Greetings,
Artur
We'll certainly look into this and help you.
Could you let us know if you kept receiving the threat pop-ups after disabling the Remote Access Shield?
Also, you can repair your AVG Internet Security once & check if that helps.
Refer to this article to repair your AVG Internet Security.
Thanks in advance. Keep us updated.
I've click "Do not show again" only.
You think, that this smb brute force attack will be repaired when i reinstall AVG?
We request you to repair your AVG Internet Security, not reinstall it.
Refer to this article to repair your AVG Internet Security.
If the issue still persists after the repair, kindly disable your Remote Access Shield temporarily & check for the issue.
Thank you for understanding. Keep us updated.
I have similar problem:
- 1 workstation, 2 node on windows10 64bit.
AVG shows waring of smb brute force attack from one node,
this happens when the node start to comunicate with workstation with Distribute Render plugin.
thanks
We will check this for you.
Could you share us the screenshot of the error message?
Refer this article for the steps to capture the screenshot : https://bit.ly/2Y6RCDP
You can post the screenshot here in your topic. Click on 'Answer' & then click on the 'Image' [mountain symbol] & follow the instructions.
i have unistalled AVG temporary and i can't take the screeshot now, when i will reinstall i will send it.
thank you
You can post the screenshot at any time. We are available round the clock.
this is the screeshot:
the url is the ipv6 address of node who is connecting with the workstataion.
If the connection is trusted, we'd request you to add the IP address of the workstation in AVG Remote access shield settings on node.
Open AVG, click Menu -> Settings -> Full Protection -> Remote access shield.
Scroll down on the right hand side and click 'Add trusted network' and enter the IP address of the Workstation.
the problem for me is IF "the connection is trusted"
Regards
Loredano
You need not worry as AVG has blocked the remote connection.
this is the setting, but the alert persist.
Kindly write back to us in your own/new post, so that we can access your account information & assist you further via email.
Thank you for understanding in advance!
We will help you in this.
The IP address you see in that pop up message, is it a trusted IP address?
If the connection is trusted, we'd request you to add the IP address of the workstation in AVG Remote access shield settings on node.
Open AVG, click Menu -> Settings -> Full Protection -> Remote access shield.
Scroll down on the right hand side and click 'Add trusted network' and enter the IP address of the Workstation.
I have the same problem. There are two Windows 10 PC's on my network which have shares with a Windows 10 PC. Just one of the Windows 10 PC's connects OK, but the other is blocked, with the same "Incoming connection blocked" pop-up repeatedly appearing. I've tried adding "trusted network" IP addresses as suggested by Rakshith Rajkumar, but without success (maybe a reboot is required?).
The only thing that has stopped the blocking is to turn off "Remote Access Shield" altogether. Not ideal, but at least I can now get access.
Any clues on how to fix this without compromising the "Remote Access Shield"?
We're glad to look into this & help you.
It isn't recommended to disable Remote access shield. Please restart your computer once after excluding the IP address & check.
If issue persists, please write back to us in your own post to investigate further on this.
Thank you for your understanding in advance!
I found the bug...
My Issues:
AVG Internet Security blocking allowed, legit LAN connections in remote access shield
Flagged as - SMB: Brute Force Attempt
Disable "Enable Samba protection" in Remote Access Shield to Fix it, it's classifying SMB as Samba...
Let's get on the ball AVG, this is an unacceptable bug!!!
We will check and help you to resolve it. Please write back to us from own separate post. So, we can check our records and help you further with it.
Keep us updated. Thank you.
some update about the issue, it persist on my local network
thank you
If you connect your device to another PC when you use AVG program, you need to add that PC IP address in alllowed list of AVG Internet Security program. If you did not add in allowed list, AVG will notify about untrusted site.
Hence, we request you to add other PC IP address to AVG Internet Security by following our previous steps and let us know the status.
If your PC have any threats or issues, AVG will check and notify you. Thank you.
Thank you for replying.
We are sorry for the trouble caused.
Please update the recent version and check the status.
Thank you and keep us updated.