locked
Firewall blocks usb programs after sleep/resume RRS feed

  • General discussion

  •  The firewall is blocking internet access to any application (portable firefox, opera, etc) that I run from my thumb drive and/or built-in sd card reader after I sleep and resume my laptop 5 or more times.  When I restart windows, all of the applications can access the internet again until hit that "magic number" and the firewall starts blocking all over again.   Any ideas on how to resolve this issue?
    Monday, December 29, 2008 8:28 AM

All replies

  • How do you know it is the firewall? It sounds like it is an issue with the USB device, actually. If you encounter the problem and then turn off the firewall, does it work? If you turn the firewall back on again does it still work? If so, then it is the firewall.
    I never counted, but I occasionally see the firewall blocking file and printer sharing after wake from sleep and the only way to resolve it is to disable/enable the firewall or reboot when it happens. It may be a related issues.
    -steve
    Microsoft MVP Windows Live / Windows Live OneCare Forum Moderator
    Monday, December 29, 2008 12:29 PM
    Moderator
  •  Hi Steve, I stopped the firewall and all of the apps worked.  When I turned it back on, all the apps were blocked again.  I tried manually removing and adding back the affected apps to the firewall policy and the problem remains.  I even restarted all of the onecare services and nothing changed.  I have no idea what to do at this point.  Any other suggestions would be appreciated.


       
    Monday, December 29, 2008 7:24 PM
  • That sure sounds like the firewall, then.
    Based on your experience and mine, there are two main possibilities:

    1. When it happens again, try disabling/enabling the firewall. Does it resolve the problem or is a reboot required?

    2. Something is causing the USB thumb drive apps to generate a new hash or signature after that "magic number" of sleep/resume cycles, causing the firewall to see new apps that are potentially malicious based on the stored signatures. Why this is, I can't imagine, nor why it takes the 5 cycles of sleep/resume to trigger it.

    When this happens, is the USB thumb drive and/or SD card left attached to the laptop during the sleep cycles? What if you remove the devices before setting the laptop to sleep? Do they still work when plugged back in fresh after the magic number of sleep cycles?
    -steve


    Microsoft MVP Windows Live / Windows Live OneCare Forum Moderator
    Tuesday, December 30, 2008 12:28 PM
    Moderator
  • Ok, this time it took 6 sleep cycles to hit the magic number.   I tried disabling/enabling the firewall and removing/reinserting all the devices and still nothing works.     

    Yes, the usb device (microdrive adapter) is plugged into the laptop's express card slot and the built-in SD reader has a 4gb card inserted during the sleep cycle.  I occasionally use the thumb drive.

    Wow, this is very weird.  When I launched firefox from the SD card,  the firewall allow/block prompt displayed the blocked app as "C:3\FirefoxPortable\FirefoxPortable.exe".  It's interesting to note that there is a "3" inserted into the path and the drive letter is wrong.  The correct path should read "D:\FirefoxPortable\FirefoxPortable.exe".   This is a really strange bug.  
     
    Rob

    System specs:
    Toshiba Satellite a105 s4344, 4gb ram
    Vista Business Ed 32bit
    Wednesday, December 31, 2008 9:12 AM
  • I think what you are running into is a problem with the U3 capability of the thumb drive. I'm guessing this because of the path you see as the blocked program. And, I'm also guessing that it keeps getting blocked because the U3 software is causing the program footprint or signature to change after the magic number of sleep cycles - hence the reason OneCare blocks it again as unknown.
    -steve
    Microsoft MVP Windows Live / Windows Live OneCare Forum Moderator
    Monday, January 5, 2009 1:52 PM
    Moderator
  • Ok, I'll stop using my U3 thumb drive for now.   I'll let you know if anything changes for the rest of my storage devices. 

    Thanks
     
    Rob
    Tuesday, January 6, 2009 12:31 AM
  • Well, I didn't use my thumb drive for a week and the problem continues to rear its ugly head.  What it comes down to is any storage device I use to access the internet, other than my internal harddrive, is blocked by some mysterious mechanism.  I really hope there is a solution to get my portable apps working properly again.  Any suggestion on what to do now?

    Thanks
    Rob
    Tuesday, January 13, 2009 1:00 AM
  • All that I can suggest is that you contact support:
     

    How to reach support (FAQ) - http://social.microsoft.com/Forums/en-US/onecareinstallandactivate/thread/30400b52-7f26-4ba0-bc18-17e305329d90

    However, based on your expereince, it would seem that the problem is not limited to U3, but is caused by the fact that the programs are being executed from removable storage. The OneCare firewall uses a "fingerprint" of the program to determine if it is a safe and known program to allow, block or prompt. Not knowing the technical details, I am assuming that residing on removable storage is causing OneCare to see these programs as changing each time you run them, hence the block.

    -steve


    Microsoft MVP Windows Live / Windows Live OneCare Forum Moderator
    Tuesday, January 13, 2009 2:05 PM
    Moderator
  • Ok - thanks for giving it your best shot.
    rob
    Thursday, January 15, 2009 9:37 PM