GlassWire

Discussion in 'other firewalls' started by Feandur, Aug 23, 2014.

  1. Tarnak

    Tarnak Registered Member

    Joined:
    Feb 5, 2007
    Posts:
    5,274
  2. Surt

    Surt Registered Member

    Joined:
    Jan 23, 2019
    Posts:
    471
    Location:
    USA
    This Win32/BlockMsav.A!reg issue was discussed in length in the GW forum. Defender was not an involved component.

    The issue was resolved in v2.2.304 after a test version (2.2.297) was released to those requesting it.
    https://www.glasswire.com/changes/

    If you're running that version or the latest v 2.3.318 and still getting the FP, you should engage GW support.
     
    Last edited: May 29, 2021
  3. paulderdash

    paulderdash Registered Member

    Joined:
    Dec 27, 2013
    Posts:
    4,638
    Location:
    Under a bushel ...
    GW Firewall has Click To Block, Ask To Connect, and Block All options. But probably paid version only.
     
  4. Triple Helix

    Triple Helix Specialist

    Joined:
    Nov 20, 2004
    Posts:
    13,262
    Location:
    Ontario, Canada
    Correct in the Paid version!

    2021-05-30_12-35-10.png
     
  5. Tinstaafl

    Tinstaafl Registered Member

    Joined:
    Jul 30, 2015
    Posts:
    965
    Location:
    USA
    Glasswire's "Ask to Connect" mode is the same thing as an auto-block mode.
     
  6. Rasheed187

    Rasheed187 Registered Member

    Joined:
    Jul 10, 2004
    Posts:
    17,546
    Location:
    The Netherlands
    OK thanks guys. I decided to try GlassWire but none of the premium features were included, what a joke. The freeware version was quite crappy, what is it, a firewall or network monitor? I didn't like it at all, I won't be checking it out again. It also used about 80MB of RAM, but apparently there is also a GlassWire Lite version, which they offer after uninstall, I wonder what that is all about. But anyway, I was not impressed.
     
  7. Surt

    Surt Registered Member

    Joined:
    Jan 23, 2019
    Posts:
    471
    Location:
    USA
    Yes.

    This bewilderment is understandable in that many are easily distracted by applications having complex frameworks.

    Allow me first to point out my post #366:
    https://www.wilderssecurity.com/posts/2804423/
    on page 15 wherein you also posted on this nearly exact dialogue.

    So now, thank you for the opportunity to clear up the unfortunate misinformation presented here in your post #456:

    All versions of GW incorporate the complete feature set:
    https://www.glasswire.com/buy/
    The differences are indicated by bold text. Well except for "All security features," i.e. no diffs.

    If you downloaded GlassWireSetup.exe from
    https://www.glasswire.com/download/
    you installed the fully featured seven day trial version. With your reference to "freeware version", there is none in the strict historical sense of that concept.

    If you sourced from a different site, please post up the URL so no one makes the same mistake.

    From their FAQ:
    Because of The Covid, GW has yet to update the Lite version information in their web pages other than a download link tagged as, "Want GlassWire to use less resources?" However, a simple startpage.com search on glasswire lite returns the likes of:
    https://blog.glasswire.com/2020/10/06/introducing-glasswire-lite/
    and
    https://forum.glasswire.com/t/specific-differences-between-glasswire-and-glasswire-lite/
    80MB is peanuts and a tribute to GW's coding expertise and Qt5 WebKit implementation.

    Cheers.
     
    Last edited: Jun 6, 2021
  8. Surt

    Surt Registered Member

    Joined:
    Jan 23, 2019
    Posts:
    471
    Location:
    USA
    I believe "auto-block" means a block evoked without ANY user intervention, ever.
     
    Last edited: Jun 6, 2021
  9. Tinstaafl

    Tinstaafl Registered Member

    Joined:
    Jul 30, 2015
    Posts:
    965
    Location:
    USA
    In my humble opinion, I would have to consider that behavior a serious bug. It would probably be better to just unplug the network cable.
     
  10. Surt

    Surt Registered Member

    Joined:
    Jan 23, 2019
    Posts:
    471
    Location:
    USA
    I meant within the context of Rasheed187's expectations in that there are literally 100's and 100's of his posts (like in this one) expressing disdain for being disturbed by any intervention event wherein his concept of "auto-block" is enumerated. And that's just in the handful of discussions I follow with RSS and I post only in those where I can present expertise for products and procedures based on years of hands-on involvement. Hence my pathetic post count. *puppy*
     
  11. Rasheed187

    Rasheed187 Registered Member

    Joined:
    Jul 10, 2004
    Posts:
    17,546
    Location:
    The Netherlands
    I don't see how this would be a bug? Like I said, certain people actually prefer stuff being auto-blocked. That's why I made the switch to TinyWall, almost all apps nowadays want to connect out, so it's annoying to keep having to respond to these outbound alerts.

    Well I don't think it's 100's of posts, but yes I did post a lot of this stuff in the SpyShelter thread. Because SpyShelter is not offering the autoblock option and I still wanted to minimize alerts, I was forced to use the "medium security level" which basically auto-trusts whitelisted software, which has both advantages and disadvantages.

    Thanks for all of the info but I didn't like GlassWire at all. And perhaps there was something wrong but the premium features really weren't available. And the network monitor from SpyShelter Firewall is way more useful in my view.
     
  12. Tinstaafl

    Tinstaafl Registered Member

    Joined:
    Jul 30, 2015
    Posts:
    965
    Location:
    USA
    Oh, are you saying that you never actually used the premium features?
     
  13. mantra

    mantra Registered Member

    Joined:
    Jan 25, 2005
    Posts:
    6,166
    Hi
    i guess the firewall works only with the pro version
    can i ask a question about rules and pro version?
    does the pro version let granular rules for an application or can I only allow or deny (when an application try to connect to the net ) ?
    thanks
     
  14. Triple Helix

    Triple Helix Specialist

    Joined:
    Nov 20, 2004
    Posts:
    13,262
    Location:
    Ontario, Canada
  15. Tarnak

    Tarnak Registered Member

    Joined:
    Feb 5, 2007
    Posts:
    5,274
    Me, too! I like your comment. :thumb:
     
  16. Surt

    Surt Registered Member

    Joined:
    Jan 23, 2019
    Posts:
    471
    Location:
    USA
    For the Pro AND Basic and Elite versions:
    When "Ask to connect" is enabled, an alert will appear where allow or block can be selected. (Enabling also "First network activity" is a handy setting as well.)
    With "Click to block," no alert, but you can check the Firewall screen and change the exe from allowed to blocked.
    Any allow or block can be reversed at any time, e.g. I have microsoftedgeupdate.exe blocked. When I feel Edge should be updated, I'll temporarily allow.
    Any rule can be removed and GW will treat the exe as an unknown and will repeat the alert or no alert depending on the ""First network activity" setting; good for troubleshooting.
    You can turn off GW's firewall and all it's rules will be disabled and can be turned on again; good for troubleshooting or during Windows Update where someone (me included) has just about every, um, unpopular Windows' service and scheduled and triggered task blocked.
    You can't allow or block an exe ahead of the above process(es).

    I wrote up how the GW firewall works within the Defender firewall here:
    https://www.wilderssecurity.com/posts/2804423/

    Though since then the rules now look like:
    {GlassWire.out.app_1025537260.profile_1.mode_2}
    and
    {GlassWire.in.app_1025537260.profile_1.mode_2}

    Cheers.
     
    Last edited: Jun 14, 2021
  17. Tinstaafl

    Tinstaafl Registered Member

    Joined:
    Jul 30, 2015
    Posts:
    965
    Location:
    USA
    To add to what Surt just posted, GlassWire writes Windows Firewall outgoing rules for any your applications that attempt to connect to the net, based on "Allow" or Deny" responses to user prompts, or click to block. You can go directly into Windows Firewall yourself and add your own rules, but I prefer to keep GlassWire in sync with Windows, so I always allow GlassWire to reset Windows Firewall to defaults at every GlassWire install (included version updates).
     
  18. mantra

    mantra Registered Member

    Joined:
    Jan 25, 2005
    Posts:
    6,166
    @Triple Helix @Surt @Tinstaafl
    hi
    well , i will give it a try
    but for a "paranoid" firewall mode (pop up for every connection of a program) there is only comodo firewall and Windows Firewall Control both update?
    thanks
     
  19. Surt

    Surt Registered Member

    Joined:
    Jan 23, 2019
    Posts:
    471
    Location:
    USA
    I've never tried that as I've always thought it's a troubleshooting tool.

    Doesn't that merely remove all the GW rules, like the examples I posted in #466 above, and you have to deal with a multitude of "First network activity" all over again?

    GW adds only its own proprietary rules in Defender Firewall and alters nothing else. So Defender is always "default." MY default. As that includes, for example, an inbound block for my LAN's Ethernet connected Roku TV and Blu-ray player.
     
  20. Tinstaafl

    Tinstaafl Registered Member

    Joined:
    Jul 30, 2015
    Posts:
    965
    Location:
    USA
    I have always assumed it just meant "reset Windows Firewall to defaults". Which is what you get if you go looking for that feature in the Windows Firewall UI. That way Windows Firewall is always set to defaults + whatever rules GlassWire has added to it.

    Then to simplify training of the GlassWire Firewall, I simply leave GlassWire in "Click to Block" mode for a few days to take care of "First Network Activity". After that I "Click to Block" any apps that I want to block permanently, and switch GlassWire to "Ask" mode. Minimal pop-ups that way. Plus GlassWire has logged everything that attempted to connect during that period, and has automatically run them thru VirusTotal. So even though anything can get through during "Click to Block" mode, you know what it was, and what it's VirusTotal score is.
     
  21. Triple Helix

    Triple Helix Specialist

    Joined:
    Nov 20, 2004
    Posts:
    13,262
    Location:
    Ontario, Canada
    I do the same and they suggest it's the best way to update to the newest version!

    2021-06-14_18-20-19.png 2021-06-14_18-21-09.png
     
  22. Triple Helix

    Triple Helix Specialist

    Joined:
    Nov 20, 2004
    Posts:
    13,262
    Location:
    Ontario, Canada
    I forgot to say there is a new version of Glasswire! https://www.glasswire.com/download/

    Version 2.3.321 - (June 4, 2021)

    Hash Full # 0581FD6157C14C4B4DD0C770DF2815EF2E9C077D346DC91A4AF0952A934314A2
    Hash Lite # 6E308C88EC283582753AA67F454437B663D78B31DB35438D52E786486E3E7C75

    • Added two new device types to "Things", as requested by users.
    • "Things" now keeps the original information GlassWire gathered even when you add your own info, as requested by users.
    • Fixed a bug that cut off hosts in some situations.
    • Users can now make longer scan intervals with "Things", as was requested in our forum.
    • "Things" now auto-scans one time on GlassWire's install, so a trial user can see what devices are on their network immediately.
    • Fixed issues with our Turkish translation.
    • Updated our Chinese translation.
    • Fixed a bug that could make GlassWire not show the correct number of online devices after the PC slept.
     
  23. Freki123

    Freki123 Registered Member

    Joined:
    Jan 20, 2015
    Posts:
    335
    The VT result can be month old results (and GW doesn't tell you the last scan date by default). I had that for a few files.
     
  24. Tinstaafl

    Tinstaafl Registered Member

    Joined:
    Jul 30, 2015
    Posts:
    965
    Location:
    USA
    Not a concern... I only run stuff from mainstream sources, and I manually check the installers with scans before I ever install them.

    VT with GlassWire is just an extra check for me, as any application that has auto-updated would be checked again when a new version is detected.
     
    Last edited: Jun 16, 2021
  25. paulderdash

    paulderdash Registered Member

    Joined:
    Dec 27, 2013
    Posts:
    4,638
    Location:
    Under a bushel ...
    That's what I thought.
    Didn't know they recommended that, as it's not default install settings.
    May try similar approach, but TBH I currently just have it at 'Click To Block' with 'First network activity' on.
     
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.