Blocked connection from Trusted computer

[cableghost]

Issue abstract: Blocked connection from Trusted computer + Simplify the exclusion process

Detailed description: I’m receiving the below blocked connection msg, though its a Trusted computer on the network.

Product & version number: 26.3.10886 (build 26.3.10886.979)

OS details: Windows 11 Pro 25H2

What is the error message you are seeing? SMB:BruteForce

See screenshots:

[Album] imgur.com

[New_Style_xd]

Tente atualizar para a nova versão 26.4.10932.

Depois verifique se continua com o mesmo problema.

[bjm]

Remote Access Protection is a newer Norton 360 security layer that specifically monitors connections like RDP (Remote Desktop) and SMB (Samba). When you see an alert for an “Incoming connection blocked = SMB:BruteForce,” it means this feature detected multiple failed attempts to log into your computer’s shared files or printers.

Why this triggered

• Failed Authentication: The most common cause is a device on your local network (like a phone, smart TV, or another laptop) trying to access your shared files using an old or incorrect password.
• Network Scanning: Some smart devices automatically scan the network for compatible “shares,” which Norton can misinterpret as a brute-force attack.
• Actual Threat: It could be a malicious device or a Remote Access Trojan (RAT) attempting to spread through your network.

How to investigate and resolve

1. Check Security History:

• Open Norton and go to Security > Security History
• Select Intrusion Prevention from the drop-down menu to see the exact IP address of the “attacker”.

2. Verify the IP: If the IP belongs to your own device (e.g., your spouse’s laptop or your smart TV), the alert is likely a false positive due to a credential mismatch.
3. Correct the credentials: On the device that triggered the alert, log out of any shared network drives and log back in with the correct, current password to stop the repeated failed attempts.
4. Add an Exception (Optional): If you are certain the device is safe, you can add its IP to the Exclusions tab in the Intrusion Prevention settings.

Learn more about Intrusion Prevention

============================================

In Norton 360 for Windows, the Remote Access Protection feature monitors network protocols like SMB to prevent unauthorized access. An “SMB:BruteForce” block on a PC often occurs because a trusted device on your local network is repeatedly failing to log into a shared folder or printer on your computer.

How to Resolve on Windows
To address this alert and stop the repeated blocks, follow these steps in your Norton 360 app:

1. Check Security History for the Source IP:

• Open your Norton product and click Security on the left pane.
• Click Security History.
• In the drop-down menu, select Intrusion Prevention.
• Find the “SMB:BruteForce” entry and click it to open Advanced Details.
• Look for the Attacking Computer IP Address. This tells you exactly which device in your house is causing the block.

2. Verify the Blocking Device:

• Identify the device associated with that IP (e.g., another laptop, a smart TV, or a media server).
• On that device, check if you have a mapped network drive or an application trying to connect to your PC with an old or incorrect password.
• Update the credentials on that device to stop the automated “brute-force” behavior.

3. Manage the Block/Exceptions:

• If you have confirmed the device is safe and its credentials are correct, you can manually remove the block within the Remote Access Protection settings in Norton.
• If you need to allow a specific remote connection, ensure your Network Trust Level is set to Private rather than Public. Go to Settings > Firewall > General Settings > Network Trust to verify.

4. Create a Firewall Exception (Advanced):

• If a specific trusted device is still blocked, you can create a general rule in the Smart Firewall to allow connections from its specific IP address. Go to Settings > Firewall > Advanced Settings > General Rules > Add to create an “Allow” rule for that local IP.

Do you recognize the IP address listed in your Security History as one of your own home devices?

AI sourced content may make mistakes

============================================

btw = toggle off to take screenshots

[bjm]

Disabling NetBIOS over TCP/IP may help by reducing your computer’s attack surface and can silence certain persistent Norton alerts. However, it is a workaround rather than a direct fix for an “SMB:BruteForce” detection.

How it Helps

• Hardens Security: NetBIOS is a legacy protocol with known vulnerabilities, such as NBNS poisoning, which hackers use to spoof identities and steal credentials.
• Eliminates “Chatter”: Disabling it stops your PC from sending and receiving legacy broadcast requests, which can sometimes trigger sensitive security software.
• Modern Compatibility: Most modern networks use DNS for name resolution, so NetBIOS is rarely necessary unless you use very old (pre-Windows 2000) devices or specific legacy apps.

The Catch
Disabling NetBIOS will not stop a device from trying to connect via SMB over port 445 (Direct Host SMB). If the Norton alert is being triggered by a modern device (like a Windows 10/11 laptop or a newer NAS) using the wrong password, the alert will likely persist because those devices primarily use port 445, not the legacy NetBIOS ports (137-139).

How to Disable NetBIOS in Windows

1. Open Control Panel > Network and Sharing Center > Change adapter settings.
2. Right-click your active network connection (Wi-Fi or Ethernet) and select Properties.
3. Select Internet Protocol Version 4 (TCP/IPv4) and click Properties.
4. Click the Advanced button, then go to the WINS tab.
5. Select Disable NetBIOS over TCP/IP and click OK.

Did disabling this stop the Norton alerts, or is the same IP address still being blocked?

AI sourced content may make mistakes