Author Topic: Ask Questions Here - ReHIPS Features & Unexpected Behaviors  (Read 172962 times)

aDVll

  • Active Testers
  • Hero Member
  • *****
  • Posts: 1119
  • Windows 10 latest 64 bit
Re: Ask Questions Here - ReHIPS Features & Unexpected Behaviors
« Reply #270 on: August 30, 2016, 12:14:29 pm »
thanks.
I like that future option.
Yep it is useful for some users. I personally always run in lockdown mode. I don't do alerts and if something is blocked i will sort it manually at some point when i have time.

shmu26

  • Active Testers
  • Sr. Member
  • *****
  • Posts: 438
  • Win10 x64 latest stable
Re: Ask Questions Here - ReHIPS Features & Unexpected Behaviors
« Reply #271 on: August 30, 2016, 12:17:58 pm »
but even with lockdown, when does the protection actually start?
malware might try to run very early, before the protection kicks in...

aDVll

  • Active Testers
  • Hero Member
  • *****
  • Posts: 1119
  • Windows 10 latest 64 bit
Re: Ask Questions Here - ReHIPS Features & Unexpected Behaviors
« Reply #272 on: August 30, 2016, 12:22:55 pm »
but even with lockdown, when does the protection actually start?
malware might try to run very early, before the protection kicks in...
It starts on system boot. First of all malware doesn't appear from thin air. For a malware to start at boot it means you allowed malware to run, not even isolated on your system. The least of your worries is starting again at boot. You are already infected and it's your fault. You either had rehips off or you allowed it and it's in whitelist now.
Assuming rehips was off and the malware is not whitelisted it might run before rehps or after. It all depends on the kind of malware and how it achieves boot. Rehips starts really early when in lockdown mode so there is a chance it gets blocked if you didn't whitelist it.

shmu26

  • Active Testers
  • Sr. Member
  • *****
  • Posts: 438
  • Win10 x64 latest stable
Re: Ask Questions Here - ReHIPS Features & Unexpected Behaviors
« Reply #273 on: August 30, 2016, 05:02:17 pm »
this is a problem that all security softs face.
I have set ReHIPS to block powershell and script interpreters, which I personally don't use, as a second line of defense. This is just in case I mistakenly allowed malware to execute.

I would suggest that ReHIPS offer various templates to the user, when the program first installs.
the template for the home user would block powershell and script interpreters by default, and template for IT pros would allow them by default, and would also allow other processes that power users need, such as the windows mounting process that Shadow Defender uses.

aDVll

  • Active Testers
  • Hero Member
  • *****
  • Posts: 1119
  • Windows 10 latest 64 bit
Re: Ask Questions Here - ReHIPS Features & Unexpected Behaviors
« Reply #274 on: August 30, 2016, 05:12:39 pm »
this is a problem that all security softs face.
I have set ReHIPS to block powershell and script interpreters, which I personally don't use, as a second line of defense. This is just in case I mistakenly allowed malware to execute.

I would suggest that ReHIPS offer various templates to the user, when the program first installs.
the template for the home user would block powershell and script interpreters by default, and template for IT pros would allow them by default, and would also allow other processes that power users need, such as the windows mounting process that Shadow Defender uses.
In the future versions you will be able to create your own templates and rules. It's in the works to provide a tool to do so and it works pretty well. Then if you wish you can maintain your own rules between release and even make rules for the specific programs you use.
You need to remember this is beta. Program is really solid and offers perfect protection but things related to ease of use will come with future release versions.
« Last Edit: August 30, 2016, 05:16:11 pm by aDVll »

shmu26

  • Active Testers
  • Sr. Member
  • *****
  • Posts: 438
  • Win10 x64 latest stable
Re: Ask Questions Here - ReHIPS Features & Unexpected Behaviors
« Reply #275 on: August 30, 2016, 05:14:46 pm »
cool
glad to hear that my ideas are already in the works...

aDVll

  • Active Testers
  • Hero Member
  • *****
  • Posts: 1119
  • Windows 10 latest 64 bit
Re: Ask Questions Here - ReHIPS Features & Unexpected Behaviors
« Reply #276 on: August 30, 2016, 05:21:40 pm »
cool
glad to hear that my ideas are already in the works...
Devs have many ideas and they are already implementing them but us users suggesting things never hurt anyone. We might get an idea they didn't think so keep the suggestions coming.  ;)

shmu26

  • Active Testers
  • Sr. Member
  • *****
  • Posts: 438
  • Win10 x64 latest stable
Re: Ask Questions Here - ReHIPS Features & Unexpected Behaviors
« Reply #277 on: August 30, 2016, 05:50:49 pm »
okay, so here's another one that you guys have probably thought of already:
when you click on "install rules", you should get a window asking  if you are sure you really want that.
It is too easy to mistakenly click on install rules, instead of on settings.

aDVll

  • Active Testers
  • Hero Member
  • *****
  • Posts: 1119
  • Windows 10 latest 64 bit
Re: Ask Questions Here - ReHIPS Features & Unexpected Behaviors
« Reply #278 on: August 30, 2016, 06:04:14 pm »
okay, so here's another one that you guys have probably thought of already:
when you click on "install rules", you should get a window asking  if you are sure you really want that.
It is too easy to mistakenly click on install rules, instead of on settings.
Yeah HJLBX suggested it already. That and a thousand more suggestions he made.  ;D

Umbra

  • Active Testers
  • Hero Member
  • *****
  • Posts: 568
  • Beta tester
Re: Ask Questions Here - ReHIPS Features & Unexpected Behaviors
« Reply #279 on: August 31, 2016, 05:44:02 am »
mostly all usability suggestion has been made by either hjlbx, ADVII, or me  :D

btw i was the one who mentioned the bad placement of the Install Rules button  :p

there is the thread i created for "usability" suggestions : https://forum.re-crypt.com/index.php?topic=2105.0 , feel free to adress suggestion there.

i think now, now most of the new suggestions will be related to specific softwares.

aDVll

  • Active Testers
  • Hero Member
  • *****
  • Posts: 1119
  • Windows 10 latest 64 bit
Re: Ask Questions Here - ReHIPS Features & Unexpected Behaviors
« Reply #280 on: August 31, 2016, 10:19:31 am »
mostly all usability suggestion has been made by either hjlbx, ADVII, or me  :D

btw i was the one who mentioned the bad placement of the Install Rules button  :p

there is the thread i created for "usability" suggestions : https://forum.re-crypt.com/index.php?topic=2105.0 , feel free to adress suggestion there.

i think now, now most of the new suggestions will be related to specific softwares.
My bad then. I found the other topic and didn't check open topic.
OK to set things clear umbrapolaris  spammed devs with a million suggestions also.  :P

Umbra

  • Active Testers
  • Hero Member
  • *****
  • Posts: 568
  • Beta tester
Re: Ask Questions Here - ReHIPS Features & Unexpected Behaviors
« Reply #281 on: August 31, 2016, 02:38:24 pm »
i was just kidding, us three have added a phonebook of suggestions/recommendaions to the dev. until they sort them all, it will be ReHIPS v3  rofl

aDVll

  • Active Testers
  • Hero Member
  • *****
  • Posts: 1119
  • Windows 10 latest 64 bit
Re: Ask Questions Here - ReHIPS Features & Unexpected Behaviors
« Reply #282 on: August 31, 2016, 02:40:15 pm »
i was just kidding, us three have added a phonebook of suggestions/recommendaions to the dev. until they sort them all, it will be ReHIPS v3  rofl
I know mate i am also joking around. The losing side is fixer side that has to code all this suggestions. We did the easy part.  :)

harsha_mic

  • Jr. Member
  • **
  • Posts: 13
Re: Ask Questions Here - ReHIPS Features & Unexpected Behaviors
« Reply #283 on: September 02, 2016, 03:30:54 pm »
I was trying to play an episode in netflix UWA in W10 64 bit. However, it failed to play with some error code.
Upon inspecting the logger, i see below is wrongly blocked causing the issue.

Quote
9/2/2016 17:50:18 PM: Program C:\Windows\System32\WWAHost.exe with PID 8228 executing program C:\Windows\System32\mfpmp.exe with PID 4752 - blocked
9/2/2016 17:50:18 PM: Program C:\Windows\System32\mfpmp.exe with PID 4752 terminated

So, i set WWAHost.exe to "inspect children" from "blocked", for the field "Can execute programs".

Perhaps we have to add it in the whitelist?

fixer

  • Administrator
  • Hero Member
  • *****
  • Posts: 1395
Re: Ask Questions Here - ReHIPS Features & Unexpected Behaviors
« Reply #284 on: September 02, 2016, 03:34:50 pm »
Thanks for your report, fixed.