Troubleshooting Anyone know what this is?

[Antimalware18]

Describe the problem

wfc popup/block

What have you tried?

reinstallation of program, virus scans

Current antivirus and security software

AVG Internet Security

For the last week everyday i have been getting this block by WFC every 5-10 minutes. I have done both options block and allow and it still pops up I know this could just be a glitch with wfc
and it not remembering rules, So i have also tried to remove the .tmp file but cant as well, ive ran Ccleaner and it didnt remove it as well as ran scans with AVG, NPE, MalwareBytes and Emsisoft all
back clean. A google search also has shown no results. I have taken steps to try to remedy it by uninstalling/reinstalling wfc as well. any help is appriciated.

 

[Bot]

It seems like the WFC (Windows Firewall Control) is having issues with a specific .tmp file. You could try to manually add a rule in WFC to permanently allow or block this file. If you can't find or delete the .tmp file, it might be hidden or locked. You could use a program like Unlocker to delete it. If the issue persists, consider contacting WFC support or use a different firewall program.

 

[Zero Knowledge]

Have you uploaded the file to VirusTotal? Maybe worth a shot.

 

[Antimalware18]

Have you uploaded the file to VirusTotal? Maybe worth a shot.

I would do that, but the file doesnt seem to exist in the location, I have view hidden files and folders checked and its still not there

 

[Jonny Quest]

Have you tried cleaning out all of the temp and %temp% files via cmd prompt as Admin in safe mode (having first disabled Bitlocker if it's enabled)?
edit: and no, I'm not sure what it is.

 

[Victor M]

The file could be in your \Users\<user>\appdata\local\temp or \windows\system32\temp. But the WFC dialog does not say specifically. So open file explorer at C: and use the search box to search for it.

If that doesn't work, look thru Task Manager > Details . Right click on column header > Select Columns> Checkmark command line. And look for the process ID shown in the WFC dialog.

 

[ForgottenSeer 114717]

For the last week everyday i have been getting this block by WFC every 5-10 minutes. I have done both options block and allow and it still pops up I know this could just be a glitch with wfc
and it not remembering rules, So i have also tried to remove the .tmp file but cant as well, ive ran Ccleaner and it didnt remove it as well as ran scans with AVG, NPE, MalwareBytes and Emsisoft all
back clean. A google search also has shown no results. I have taken steps to try to remedy it by uninstalling/reinstalling wfc as well. any help is appriciated.
View attachment 288104

Open Task Manager > Details > Search for Process IDs

Search C:\ for "mkuotwag"

Try resetting all your WFC rules to default

 

[Antimalware18]

found out its safe, its related to Nordvpn. now i just need to stop it from popping up all the time. thanks for the advice everyone.