Behavior:Win32/WDBlockFirewallRule.P

@Niorun

I think I have emailed everyone the fix who asked. If you didn’t get it please let me know, and please let me know your results with the update via email.

For anyone else, please email me with a link to this thread in the subject and I can send the new version to you.
https://www.glasswire.com/contact/

When will the official version be out that fixes the problem?

@Finis_Ronin

I believe once it goes through quality assurance testing (and if everything is OK) early next week hopefully. If you’d like to email me I can send it to you now.

Hello everyone, we now have an even newer build for this. Email us with this thread in the subject of the email and I’ll send it to you for testing.

https://www.glasswire.com/contact/

Nah it’s ok I wait for the official release.

1 Like

@Geri123

Glad it works. We will have an update out next week.

If anyone wants to try the update before it’s out on Monday you can email me a link to this thread in the subject of your email.
https://www.glasswire.com/contact/

Just a reminder… Please see the post directly above if you’d like to try the release before it’s out next week. Thanks everyone for reporting this issue and thanks for helping us test!

The update will be out Wednesday, thanks for your patience. Please email me if you want the update in advance of the public release.
https://www.glasswire.com/contact/

Please make the email subject the link to this forum thread.

This issue is fixed with GlassWire 2.2.304. Please install this new version to solve the problem.

I’ve installed the latest update (after uninstalling it for about a month because it was doing this) and it is still doing it for me. I am not sure how to go about fixing this. Windows randomly started prompting this about a month ago, and now everytime I go to install GlassWire, it gives me this. I will uninstall it for now.

Interesting enough, the firewall does seem to be working. I can block applications and they are blocked, but it can become annoying if everytime I boot windows it does this over and over again.

@Slvrbuu

Please go to add/remove programs and uninstall GlassWire.
Now go to the Windows Firewall control panel and choose “restore defaults”.
Reboot
Install our latest version that solves this, and check “clean install” and “reset firewall”.
The issue should be fixed.

1 Like

Same for me, and after reading this post and quickly analyzing what could have happened, I think I understand the concern. It is not a detection of a real malware but more a heuristic alert to guard against a possible malicious action, except that the Windows Defender alert refers to the attempt to register in the Windows firewall of a rule by GlassWire when the firewall is active (whether set to ‘block all’ or ‘ask on connection’)

SYSTEM

  • Windows 10 Home (x64) 20H2 (19042.867)
  • GlassWire (2.2.268): Firewall configured as “ask on connection”

PROCEDURE
I had recently started my PC, and only read an article on Google News, then wanted to open ‘Epic Games’ to see if any games had any updates. The Epic Games client all just opened that Windows Defender displayed the alert with the obligation to reboot the system.

ApplicationFrameHost_KjDdp9b9vC

On restart, I saw the alert in more detail, and I immediately understood when I saw what it was and the source indicated by Windows Defender (PID of GlassWire was 4216 like the alert message and the REG entry are formated like other GlassWire’s rules). Windows Defender had blocked the inscription, no trace of the reg entry so maybe this will create next time.

When you launch the Epic Games client, it connects to its servers through two separate processes and checks for updates to the client, and subsequently the games. Since I haven’t launched the client for a long time, it must have fetched a new version and tried to launch it except GlassWire did not display a firewall message.

I think Windows Defender and GlassWire at the same time attempted to scan and register the firewall rule update and this turned on the heuristic alert.

GLASSWIRE VERSION
GlassWire_2aluzEhI1E

FIREWALL MODE
GlassWire_qkdjqIo5jp

TL; DR
In the end, it’s a little scary at first, maybe a little longer for the less adept, but it’s a good enough sign and shows that Windows Defender is very vigilant. This does not prevent the firewall from being managed by GlassWire after reboot, and to put it philosophically, it is better to have protection that has a few false positives rather than having a real threat passing through.

Certainly, if it turns out that it is possible for GlasseWire to better negotiate this kind of situation, that would be so much the better, in any case, for more than a year that I have been using GlassWire with the firewall on "ask on login "and opening Steam clients, Epic Games, etc. every day, this is the first time this has happened.

1 Like

This is already solved in GlassWire 2.2.304. If you are still having the issue:

  1. Go to add/remove programs and uninstall GlassWire.
  2. Reboot
  3. Go to Windows Firewall and choose “restore defaults”.
  4. Reinstall GlassWire and choose “reset firewall”
    @Geri123

Please note if you’re still having this issue after following the instructions above then perhaps you have another firewall installed. I recommend uninstalling that app. It may be holding your firewall rules in place since it stays installed, and that will cause this issue.

I had some other customers who continued to have this issue and we found the rules were from another firewall application they had installed that they had forgotten about. Go to add/remove programs in Windows and look for any other firewalls that are installed, then uninstall them.

Exactly what I found for information.
This is indeed linked to a change in the behavior of Windows Defender.

And the same here, the old versions of Windows protections remain without possible deletions.

My fear is that GlassWire is stuck with offering reinstall and reset rules as an easy way out.
At the moment it doesn’t matter to me but in a few months, it will be different.

1 Like

Thanks for the reply, although I actually have no problem.
I only wanted to bring my feedback.

For my part, GlassWire is not responsible for this problem and works fine.
The rest of the system like Windows Defender or Firewall too.

All this matter is related to a behavioral protection of Windows Defender which caused a false positive.
It is a protection rule, which was integrated fairly recently from what I could find as info, and which is triggered by Windows Defender.

Behavior: Win32 / WDBlockFirewallRule.P
Microsoft Defender recognizes when firewall rules are created to block comms with the cloud platform!

This false positive should certainly not happen, but it’s like all false positives, there are often several elements that come into play, possible that the moment when the action took place had its impact and like any Fairly recent rule, it takes a little time for the log and false positive returns to be analyzed by the Microsoft teams (after they adjust, create exceptions, or other method).

For beginners, remember that following such an alert, there is no problem (in this specific case), the firewall rule has not been registered.

This does not mean that it cannot recur the same type of alert, since as I said it depends on an internal rule in Microsoft Windows Defender but the good news is that of this kind are often adjusted, modified, as and when false positive returns come up (Microsoft Board, twitter, etc.). However, GlassWire has a role to play in the escalation process as well.

1 Like

Thanks @Geri123. We will investigate.

If you go to the top left GlassWire menu and choose “About”, what version do you have there? What firewall mode are you in with GlassWire? Do you use any other firewall software?

This is an issue you are seeing with Windows 10, not the new beta Windows 11, correct?

Nobody else has reported this issue and we’re unable to recreate it. We will continue to investigate.

I’d guess it’s due to something that other app is doing, but I cannot confirm this. I am not familiar with every single thing that app is blocking but perhaps it’s something Microsoft does not like.

We usually get feedback right away from a large number of our users if GlassWire is causing this type of issue. So far we have only seen your report in our forum, helpdesk email, and social media but we’ll continue to watch out for other reports.

Thanks for taking the time to make this report and include those details.

I did a little more research and I found others reporting a similar issue with the tool you are using. Although the thread is quite old, I don’t think this problem is related to GlassWire.

oh my god is this issue still going on?