I normally play Window Media Player in full screen mode. Everyday at 10am when I playing tv feed(s) from Greece on Windows media player something bumps windows media player out of full screen mode and the feed continues to play. Is there some sort of setup in CIS to block this from happening? I have CIS4 on that particulair system. Just know that 2 months ago I came off a subscription from GData Security suite and it was not happenning then. Before CIS I tried Avira and it was happening then too.
So maybe my question is how to I setup WMP with tighter parameters in Firewall and/or Defense+?
May be it is the av updating. Disable “Automatically update the av database” in Scanner Settings → General. Or disable “Show balloon messages” in More → Preferences → General.
Yes I unchecked both things and again today right at 10am WMP dropped from full screen. I will have to look an see if there is any network activity tomorrow when I watch it to see if something is there.
In the meantime any other suggestions? Is it possible for script to be put in that forces a drop of full screen in windows media player?
Are you watching in a browser? Try running WMP on its own rather than from the browser.
I am using wmp on it’s own. I noticed that part of my ati video card software is missing this morning. I will look in that tonight.
This evening (Tuesday) I had to reinstall ATI Catalyst software. Seems like it just disappeared at some point. I have an older Radeon 7000 card. The driver seemed to be intact and device manager indicated the card is working ok. I will see in the morning at 10am if the WMP drops out of full screen. Strange how that software just disappeared.
Just when I thought things were going good WMP was bumped from full screen at 12:30pm instead of 10am today. It don’t make sense.
Oh yea last night Comodo software decided to upgrade from 4 to 5 version too.
Take a look at task scheduler to see what programs are scheduled to start at the given points of time. Task Scheduler can be found in Control Panel → Administrative Tools.
There is nothing in task scheduler. Something else I am trying is limiting the ports that WMP can use via Firewall-network security policy based on what the server side is using from this article…
http://www.microsoft.com/windows/windowsmedia/forpros/serve/firewall.aspx
Since Comodo don’t have rules for MMS and RTSP streaming I made my own under application rules with Windows Media Player. I will probably need to play with it to make it tight as possible. Unless someone already has this part figured out so I don’t need to reinvent the wheel.
Seems worse today. Oh well lesson learned to leave well enough alone when I had the other software on this system.
The Microsoft KB article is all about the situation when WMP is used to stream content to other computers. So, it does not apply to your situation.
To see if CIS plays a role take a look at the Defense + logs. They are under View Defense + Events. Can you post a screenshot of them?
To see if Firewall events play a role let’s take a look at the Firewall logs. They are under View Firewall -->Events.
But before we can set this in motion I need to be sure logging enabled. Do you see a rule for WMP in Network Security Policy → Application Rules? If so does it have a log rule? When you don’t see a log rule set it to Outgoing Only. When you don’t see a rule for WMP add one. That easiest done when WMP is running. Give it the Outgoing Only policy.
Ok I will post logs when I can.
I did give WMP outgoing only but RTSP UDP dont work. You see I have my WMP to only receive RTSP using UDP (since UDP works best for Streaming) sooo for the rules for WMP I did a copy of outgoing rules and added a “UDP in” before the “Block and Log All Unmatching Requests” so that “UDP in” is step 2 and step 1 ofcourse lets everything go out.
I have all three steps set to log now.
For the UDP in I set any source and any destination IP, source port is set to 5004 as per Microsoft KB for RTSP and destination port I used the range of 1024-5000 because it seems to be random.
Let’s just see what heppens now.
When I did the things in my last post WMP did bump once out of full screen then subsequent times WMP player stopped playing the feed all together couple of times. No new logging in Defense+ but in Firewall logging I saw that WMP tried to phone home to a Microsoft IP address even though I have codec update disabled in WMP. So now what I did is change the outgoing rule to only allow Port 554 for destination with 1024-5000 for source ports as an out rule. So now there is a total of 4 rules for WMP and thats it.
It’s interestiing now. I am getting a lot of “blocked” connection from port 5005 which according to the Microsoft KB (above) is used for packet loss count on the clients and control messages. I am going to leave like this to see what happens.
It still happens and I not seeing anything in either the Defense log or Firewall log for when it occurs.
Question under Defense+ settings> Monitor Settings in the section “objects to monitor against direct access” what does “computer monitor” do when it’s checked? How would Comodo interact with Window Media player when playing full screen when that feature is checked?
Thanks.