iexplore allowed no prompt in rules wizard mode

[grey ghost]

I came across a situation with iexplore while surfing he wb.

Iexplore is in the applcations= partially allowed

Jetcar.exe is also in applications=partially allowed

There are no rules for either application.

msimn.exe and wallwatcher are in the application= trusted applications.

There are no rules for these applications.

As you can see by the screen shot below iexplore is being allowed with no prompt by Outpost.

Allow outgoing DNS for jetcar is in response to my download request. (resolving the download ).

[Danil]

Gerry, what rules do you have for Iexplore in Partially Trusted Apps? Double click on Iexplore to see them.

[v_profiler]

Hi grey ghost,
sorry to ask for this but is there a possibility that you first gave IE and Jetcar trust always permission and than later moved them to partial allowed applications?
cu

[grey ghost]

Originally posted by Danil
Gerry, what rules do you have for Iexplore in Partially Trusted Apps? Double click on Iexplore to see them.

Danial, Please see screen shot below.

I did not create rules using preset >Browser.

[WizzOzz]

The problem is, that IE was suddenly a trusted app with presets?

Can this be reproduced? (on my system its working as it should)

[v_profiler]

Sorry I think I missunderstand you, I thought there weren´t rules for these applications. BUT am I wrong, why IE needs permisson by prompt? You allow it IE default settings and gave permisson to use HTTP or? Maybe I missunderstood again. If yes, sorry!!!

[Danil]

I'm in the same confision as v_profiler :confused: ...

On your first screenshot we see that HTTP connection is allowed for iexplorer.

On your second screenshot we see that you have the rule 'to allow Internet explorer HTTP connection'.

So what is the problem?

As you set the rule then there should be no prompt message...

Did I misunderstand you?

[grey ghost]

I have a post on a problem with a router log viewer..

phttp://www.outpostfirewall.com/forum/showthread.php?s=&threadid=2356

As you can see the viewer was blocked in rules wizard mode even though it was in the always allow and trusted applications.

Today when I started Wall Watcher and Outpost. Wall Watcher was in the blocked mode log when a small word appeared by Wall Watcher (resolving).

Wall Watcher was then removed from the blocked mode and entered into the allowed mode. That has not happened before in rules wizard mode. Wall Watcher was now working.

That was when I noticed Iexplore exe was not being prompted by Outpost.
Mikhail has been working on this WallWatcher problem ie.. learning mode.

I will e-mail him with this new information.

v_profiler as you can see jetcar.exe is only allowed once but not Iexplore.exe both in the same setting. Partially allowed no rules made by me.

I removed Iexplore .exe and it is now being blocked. Added it to the partially allowed applications.

[grey ghost]

The answer to all he above questions is

1. I did not allow or write rules to allow iexploe .exe

2. It seemed that when Outpost resolved Wallwatcher from blocked to allowed that iexplore was for some reason also allowed ? :confused:

3. It now seems that by removing iexplore it is now working again.

WizzOzz yes that is correct why was it allowed?

[v_profiler]

Sorry grey ghost, don´t get me wrong but it´s :D :D :D (funny :confused: ), or to be serious it should be a bug.
At least I have to thank you very much because of the link you post. I didn´t remember this thread and now you teached me that I already saw some bugs without knowing it (learning mode).
I only have to reproduce them :(
thanks

[WizzOzz]

WizzOzz yes that is correct why was it allowed? [/B]
I dont know. Until now, this is the first post of an app which creates automatically presets.

In your default ruleset there is no IE application? You have to press everytime you surf to a website allow once?
Is this right?

[v_profiler]

Hi grey ghost,
I know I shouldn´t post again in this thread after all my missunderstandings but refering to the link to your other thread I found this information in the WallWatcher manual.

If WW only logs its starting and ending times, it is not receiving log messages from your Router. This can happen for two reasons: the Router is not setup to send log messages to your computer (see Installation), or you're running a software firewall on your computer. If you are using a software firewall, it may prevent WW from communicating with the Router and/or with your ISP's nameserver. Those are the only two external locations WW uses. It doesn't communicate with other web sites. To use WW, you must tell the software firewall to allow these communications from the Router:
The Router is usually at address 192.168.1.1
The log messages are always on UDP port 162
Nameserver communication is through TCP port 53
Some software firewalls may allow these communications at low or medium security but not at high security. Some software firewalls (e.g., ZoneAlarm) detect each new version of WW and require you to re-authorize its use. If you've set the Router to block Internet access by the computer running WW, or have not told your software firewall to allow WW to perform DNS name resolution (on TCP port 53), you must also tell WW to not attempt to convert IP Addresses or URLs. Otherwise, WW may seem to freeze for up to a minute each time it receives a log message from the Router. These options are on WW's "Status" menu, and are enabled by default. Click each one to disable it as soon as WW starts. You only need to do this once: WW will remember these settings

Maybe your problem from the old thread is already solved, or you already read this, if not maybe you give it a try to create these rulse as a default rule-set or as a partial allowed (I know it should work in trusted application, so it´s only a try) For shure this won´t be the answer on how your IE got suddenly the default rule-set.

or additonally
wwtroubleshooting (http://www.sonic.net/~sraaii/wallwatcher/WwProblems.html)
cu :)

[grey ghost]

That's correct.
I was working with Outpost trying to see if I could get WallWatcher working in rules wizard mode.

I need to click allow when a webpage loads. Many clicks. :)

The funny thing is I just downloaded and installed Beta 1.0.
I rebooted started Outpost all the applications were still in the same configuration.

Rules wizard mode WallWatcher and Iexplore.exe etc.
All running correctly or so it appears right now.

I guess this is the fun with Beta testing. :)

[grey ghost]

v_profiler

Thanks for the info.

I had created those rules and Outpost allowed WallWatcher.

The problem was when an incoming request is blocked by Outpost the only options are
Always allow, never allow. or create rules.

You do not have the option to allow or block once.

I selected always allow for WallWatcher.

Outpost put WallWatcher into (learn mode) a bug.

It always blocked WallWatcher even though it was in the trusted applications always allow.

You should not have to make rules if always allow is selected.

[WizzOzz]

The latest beta runs good on my system. :)

Grey, did you tried to enter the router ip under trusted? (as an idea?)

[grey ghost]

Originally posted by WizzOzz
The latest beta runs good on my system. :)

Grey, did you tried to enter the router ip under trusted? (as an idea?)

WizzOzz yes it worked with the ip under trusted, also if Outpost was in AllowMost Mode.

The problem was in rules wizard always allow.

If this thread continues I'll make senior member.:D

[WizzOzz]

Ok... lets try to end this.
Summary:
- Out of nowhere IE was a partially allowed app, but we dont know why and without a way to reproduce it, we wont have a chance to find it out.
- The latest beta fixed the problems with your router & wallwatcher?

[grey ghost]

WizzOzz

Yes with the newest beta so far so good.
Everything seems okay.

[grey ghost]

Sorry to post again.
I could not let the thread end with the wrong information.

The latest beta does not eliminate the problem. In rules wizard mode.

If Outpost is running before WallWatcher it temporarily allows activity in blocked. Then transfers it to allowed and it logs correctly.

If WallWatcher is running first then Outpost starts it puts WallWatcher in learning mode blocked it then transfers to learning mode allowed and blocks logging.

When the new beta was downloaded the default is to run Outpost at start up. That is why I thought the new version had corrected the problem.

I have WallWatcher running to monitor any router activity.
I run Outpost to surf, check mail, gruntella etc.

[Mikhail]

If Outpost is running before WallWatcher it temporarily allows activity in blocked. Then transfers it to allowed and it logs correctly.
What does it mean "allows activity in blocked"?

Sorry I do not undertstand where the problem is..

[grey ghost]

Originally posted by Mikhail

What does it mean "allows activity in blocked"?

Sorry I do not undertstand where the problem is..

Mikhail,
Please see the zip files below.
If Outpost is running before WallWatcher. Outpost puts WallWatcher into/or blocks it and logs it as allow all activity in the blocked log.
After a short period of time it shows (resolving) WallWatcher. Outpost then moves the entry to the allowed log allow all activity for this application. WallWatcher then starts showing the router activity.

If WallWatcher is running first and then Outpost starts it starts to block WallWatcher and puts an entry in the blocked log learning mode.

[grey ghost]

Please see the zip file below.

This shows Outpost activity If Outpost starts running AFTER WallWatcher.
In the WallWatcher viewer gif. I started WallWatcher then started Outpost Went to Agnitum Forums but no entry in WallWatcher as Outpost was now blocking it in learning mode.

Once again the sequence is

1. Outpost shows WallWatcher in the blocked log in the learning mode. Sometimes after a period of time it resolves WallWatcher and moves the learning mode from the blocked log to the allow log. But it still blocks the viewer.

Most of the time it remains in the blocked log learning mode.