Attempt to connect to your computer using Remote Desktop

AVG Protection
5

screenshot
The IP address in the screenshot is redacted, but, for discussion purposes, it is 192.168.1.200.  

I have isolated this problem to legitimate attempts by 192.168.1.200 to access an SMB share on the computer receiving the warnings.  This access is expacted and has been in use for years.  AVG has now decided to block it.  I'm not sure why this changed.  There is another host accessing the same SMB share on my LAN that is not blocked by AVG.

When I disable AVG's "Remote Access Shield", the access is restored and the warnings cease.  It looks like I have resolved the issue by checking the box "Block all connections except the following" and adding 192.168.1.200 (and others) to the whitelist.   I am satisfied with this workaround and I believe it will enhance my security, at the expense of additional maintenance tasks.

4

Hi Robert,

We're glad to look into this & help you.
From your description, it seems that Remote access shield is blocking the access of the network computer (Brute-force attack).
To ensure this, share us the screenshot of the notification that you receive, after clicking on 'See details' in it.

1

I have started repeatedly getting an alert from AVG:
"an attempt to connect to your computer using Remote Desktop"

In the details it gives a URL smb://192.168.1.200/BruteForce
That IP address is another (different) computer on my LAN (also protected with AVG).than the one getting the alert.

Does this mean that 192.168.1.200 is the attacker?  Why is the URL starting with "smb://" if this is Remote Desktop Protocol?  Is there any other info available on this attack?

I seem to stop getting alerts when 192.168.1.200 is powered down.  However, since the alert on the machine that is presumably under attack is so vague, I'm having trouble pinpointing the source of the problem.

Thanks!

2

Hi Robert,

We're glad to look into this & help you.
From your description, it seems that Remote access shield is blocking the access of the network computer (Brute-force attack).
To ensure this, share us the screenshot of the notification that you receive, after clicking on 'See details' in it.

3

Thank you for sharing a valuable workaround, Robert.

We request you to keep monitoring the situation & if the issue recurs, please contact us immediately.
We'll check & assist you accordingly.