how can this program bypass the firewall?

Hi

xnview is a great software free and clean

but when it checks for update , it bypass the firewall

i tried with eset smart security and look and stop

at check for update no pop up

can you explain it?

thanks

 

It is whitelisted?

 

nope , i don't think
and i disabled it the whitelist

 

Have never used the program myself so not sure how it's updating but it might be using a webservice that is using http 80 traffic that you have open already for your Web browser maybe?

You could download and run WireShark and have a look at the packets and then know for sure where and how it's talking if your current firewall is not logging it, though it should be.

http://www.wireshark.org/

 

Possible reason might be you are running some local proxy software, avast webshield is one, but there are many others. Perhaps those firewalls are not able to filter that loop hole. I know Windows firewall can't.

Avast had mitigated the problem a bit by allowing only known browsers on TCP 80.

 

if you use ZoneAlarm free firewall and block the update for this program then i am sure it will not bypass.

You may try it and tell us the result.

 

But I guess any decent firewall should be able to block this program. Better to check with ESET support how to setup ESET firewall to warn you about software connecting to internet. I am sure you are missing something on ESET firewall configuration or application control.

 

here you have it, ZoneAlarm free blocks xnview. good luck

 

Comodo firewall with custom ruleset would alert to this.

 

thanks a lot to everybody
can't understand why it bypass my firewall

 

wireshark is not free
is there a free and maybe portable version or at least free?
i would appreciate it a lot

maybe nsoft should i developt at least 1 program

 

At this time Zonealarm is incompatible with Avast...

They are working on it...

rrrh1 (arch1)

 

Interesting, working on it? Do you have please a link in which AVAST confirms its working on it? I could not find it so far.

Thanks,
Fax

 

Free:
http://www.wireshark.org/download.html

 

hi

i'm considering a security suite alternative to smart security

the new forum and the supprot is

so zonealarm can detect it

i tried smart security 6 and 5 , look and stop and they don't detect it

outside wireshark is there a portable program created by nirsoft that can do it

 

If LnS did not reported then it uses system programs or settings which were already made. check or post your LnS settings if you dare

BTW i also use xnview and windows 8 firewall control from sphinxsoft detects its outgoing request. so i assume same as above - either misconfigured proxy settings in internet explorer or you system has certain vulnerabilities you cannot handle any longer - a zombie computer used for bot attacks.

 

which firewall? can you name it ?

 

eset smart security and look and stop

 

may i know what protocol does it use? i mean xnview

i have windows 7 64bit full updated and smart security updated ,plus malwarebyte

what should i do?
i have very few software installed and all legit!
so?

thanks

 

For a test, first make sure that you have no allow rule for this program, then put the ESS firewall into Policy-based mode and see if it makes a difference?
In this mode every connection attempt in/out will be blocked unless there is a rule.

 

It is xnview.exe, TCP 80 and the remote IP is 178.33.105.203 from my location.
Xnview->Info->Check for Update...
Used Windows firewall with TinyWall controller. It seems to be just a normal program with no special internet access tricks.

I just tested the software on Sandboxie. With SBIE you can disallow all internet access, except for those programs you whitelist, so even if you had a local proxy program running on your system or some "baddie", Xnview sandboxed would not be allowed internet access with that setting, unless whitelisted by SBIE1307 popup.

 

use ZoneAlarm free firewall then you are much safer.

 

Zonealarm is working on it not Avast...

abut as clear as mud...hope this clears it up a bit.

rrrh1 (arch1)

 

I am afraid not an issue with ZA. All started with AVAST 9, not ZA. But if you say ZA is fixing it, I believe you. Not sure where you got the info anyway...

 

thanks , i appreciate it a lot Jarmo!
a program like cports nirsoftware should detect it?
in the filter i added includerocess:xnview.exe

even curreport detect connections created by xnview info->check for update