** post edited slightly to better explain the issue I'm having **
Greetings ReHIPSers,
I've been testing ReHIPS 2.2.0 for a few days now, primarily switching it to learning mode (i.e. disabled at startup) and then playing around with different browsers and programs. My first time booting up with ReHIPS active/learning is causing my system to freeze at the 'Welcome...' screen on Win 7 64-bit. No HDD activity during that time either it seems. I've barely played with any settings within ReHIPS, and have since tried a clean install just to make sure I hadn't inadvertently changed a setting or two: no change either way.
I'm using very little else in terms of real-time security, just Win 7 MSE with occasional (on-demand) scans from Malwarebytes and CCleaner. I'm not entirely sure what sort of further info might be relevant at this point. I don't think I've tested a Beta release of anything, but ReHIPS has definitely caught my attention.
If this is one of those questions that has already been asked 584 times then you have my apologies in advance. ;D
Are you on Admin Account or SUA?
in both case, anyway ReHIPS is loading at startup , only the GUI doesn't if you are on SUA , for that you have to do 2 steps:
1- go to : Settings > interface > tick "autostart"
2- go to : Settings > Trusted Users > move the SUA account to the Trusted Users column.
Try this and report to us if any amelioration (or not) are visible.
Thanks for the quick reply Umbra -
Just to clarify what I'd meant to say; I was initially booting to the desktop with ReHIPS deactivated, and only changing it to learning mode from the desktop (and back again before powering down). I've been running it from a SUA.
I'll report back shortly.
Quote from: umbrapolaris on March 27, 2017, 04:28:58 PM
Are you on Admin Account or SUA?
in both case, anyway ReHIPS is loading at startup , only the GUI doesn't if you are on SUA , for that you have to do 2 steps:
1- go to : Settings > interface > tick "autostart"
2- go to : Settings > Trusted Users > move the SUA account to the Trusted Users column.
Try this and report to us if any amelioration (or not) are visible.
No difference unfortunately - I can't access either account (admin or SUA), just hangs at the welcome screen. Only option at the moment is booting in safe mode and/or uninstalling ReHIPS.
Did you collect the logs before uninstalling? because this is the kind of issues the devs like to be aware of.
No I didn't I'm afraid, but I don't mind recreating the issue with a new installation. Does ReHIPS have it's own log files or would I be looking for the output in Event Viewer?
Quote from: Funnelhead on March 28, 2017, 11:27:05 AM
No I didn't I'm afraid, but I don't mind recreating the issue with a new installation. Does ReHIPS have it's own log files or would I be looking for the output in Event Viewer?
Rehips has a section in event logs with it's own logs. You can export that when you manage to reproduce your issue.
Hello, Funnelhead.
Thank you for your report. We'll be very grateful if you help us investigate it.
If autostart is disabled, Windows boots OK. Am I correct? What if autostart is enabled, but ReHIPS mode is set to disabled, does it boot OK? I suppose you have Lock-Down mode in Settings set to Disabled?
Hi Crasher,
Quote from: crasher on March 28, 2017, 12:42:03 PMWhat if autostart is enabled, but ReHIPS mode is set to disabled, does it boot OK?
Yep, that's what I meant to say if my first thread. With ReHIPS disabled but autostart enabled, it loads just fine. I can then set it to Learning or above from the control center and use normally, and deactivate prior to logging off.
Quote from: crasher on March 28, 2017, 12:42:03 PMIf autostart is disabled, Windows boots OK. Am I correct?
Not quite; with autostart
enabled and ReHIPS set to Learning or above, it freezes at the welcome screen. This is true both for my SUA and Admin accounts. I've yet to try it with autostart disabled but ReHIPS active.
Opening post now edited for clarity.
... and assuming lock-down mode is off by default, then it will have been disabled the whole time.
Could you send me ReHIPS events log from Windows Event Log-Applications and Services Log-ReCrypt, it has all events, including the ones occurred without GUI?
Do Ctrl+Shift+Esc or Ctrl+Alt+Del do anything? Or hung welcome screen is still shown?
Quote from: crasher on March 28, 2017, 01:36:28 PM
Could you send me ReHIPS events log from Windows Event Log-Applications and Services Log-ReCrypt, it has all events, including the ones occurred without GUI?
Do Ctrl+Shift+Esc or Ctrl+Alt+Del do anything? Or hung welcome screen is still shown?
Do you mean the logs specifically from
after the freeze/crash at the welcome screen? If so, the system is entirely unresponsive, forcing me to reboot or power off. But, I may be able to access the event viewer from Safe Mode after I've restarted, but prior to uninstalling ReHIPS. Let me know if you think this might help!
That's right, logs AFTER it hung, but before uninstall. ReHIPS isn't loaded in safe mode, bug logs are accessible from there, so safe mode is the best way to go. And try the shortcuts I previously mentioned, who knows, maybe it's not hung completely and they'll help get to the desktop. Thank you for your help.
Recreated the error again; neither of the shortcuts listed above make any difference during the welcome screen. I'm now back in to safe mode and looking at the Event Viewer.
Should I be selecting Event Viewer > Apps & Service Logs > ReCrypt > Save All Events ?
Yeah, save all events in a file, upload the file somewhere and give me the link. We'll take a look, maybe it'll shed some light on what went wrong.
PM sent.
We examined the log. Between 13:38:00 and 13:44:39 (the last event for today) of today it doesn't seem like OS was booted. More looks like some user session was in process, someone was doing something, launching vivaldi, closing mmc, and then rebooted or shut Windows down. Are you sure you just booted, encountered hung welcome and reset the computer around 13:43-13:44?
These opened handles are OK, ReHIPS monitors for changes in installed software to install rules for new software if needed. But could you also please check Event Viewer->Windows Logs->Application and System, maybe there are some program crashing events or anything else out of place?
Yeah, now that I've had a closer look myself, ReCrypt log doesn't seem to show anything at the point where the system boots and ultimately results in the freeze/crash.
Under Event Viewer > Windows Logs > Application there are a few entries marked 13:45 / 46 and then nothing until a minute or so later when I power the machine off "13:46:58 The system has rebooted without cleanly shutting down first."
In particular, one entry states "14:45:05 The winlogon notification subscriber <Profiles> is taking long time to handle the notification event (Logon)."
That's preceded by one that states "The EventSystem sub system is suppressing duplicate event log entries for a duration of 86400 seconds." and another "The Desktop Window Manager has exited with code (0x40010004)".
I can see one or two others that relate to Adobe Update Manager (or whatever it's called) and another for the iGPU.
I'll try a few further reboots just to check the timings for some of these entries...
Update:
After a bit of research, I decided to go down the route of restarting the system with a clean boot - https://support.microsoft.com/en-gb/help/929135/how-to-perform-a-clean-boot-in-windows.
Via safe mode & msconfig, I deactivated all 3rd-party services (and all startup items) apart from ReHIPS service and the .exe file that appears in the startup tab. Through some trial and error, I've managed to narrow it down to the following services as appearing to interfere with ReHIPS during boot.
Asus Com Service
Asus HM Com Service
Bonjour Service
The first two are components of ASUS AI Suite, which I use specifically for Fan Xpert 2 (fan control software). This is relatively old software for a Z77 chipset, but it's also the newest incarnation that my motherboard supports.
I'm not even sure if I need Bonjour service at this point; I've long forgotten which programs required it, and similarly, it's probably hasn't been updated for a few years.
Although I'm tempted to remove and/or update all of the offending services, I'll leave them as they are for now, in case the ReHIPS team want me to provide any more data.
Quote from: Funnelhead on March 29, 2017, 05:47:34 PM
Update:
After a bit of research, I decided to go down the route of restarting the system with a clean boot - https://support.microsoft.com/en-gb/help/929135/how-to-perform-a-clean-boot-in-windows.
Via safe mode & msconfig, I deactivated all 3rd-party services (and all startup items) apart from ReHIPS service and the .exe file that appears in the startup tab. Through some trial and error, I've managed to narrow it down to the following services as appearing to interfere with ReHIPS during boot.
Asus Com Service
Asus HM Com Service
Bonjour Service
The first two are components of ASUS AI Suite, which I use specifically for Fan Xpert 2 (fan control software). This is relatively old software for a Z77 chipset, but it's also the newest incarnation that my motherboard supports.
I'm not even sure if I need Bonjour service at this point; I've long forgotten which programs required it, and similarly, it's probably hasn't been updated for a few years.
Although I'm tempted to remove and/or update all of the offending services, I'll leave them as they are for now, in case the ReHIPS team want me to provide any more data.
You don't have to uninstall the programs. Just change the services startup type to disabled 1 by 1 to see which one is creating the problem. ;)
That's how I know that the services listed above are the ones that are causing the problem. Ultimately though, I'd prefer to remove/update or at least find a workaround for those services rather than just deactivate them. Ideally, I need the two ASUS services to be active.
do you need those services immediately, if not you can try delayed start for those services
Fixed.
Thanks to Fixer and the rest of the team for taking the time to track this one down: working perfectly now!
I'd like to thank Funnelhead for his time and help in this issue investigation. This was an interesting issue and fixing it wouldn't be possible without him.