Jump to content

Security Cams blocked


Recommended Posts

about 2 weeks ago I lost the ability to view my security cams on my 2 computers. They work fine if I completely disable MalwareBytes, all 4 components.

I added the DVR IP address and the viewer executable to the Allow List, but that didn't help.

MBAM version: 4.0.4

Security Cam viewer: iVMS-4200  from hikvision

any and all help are greatly appreciated

 

Link to post
Share on other sites

  • Staff

***This is an automated reply***

Hi,

Thanks for posting in the Malwarebytes for Windows Help forum.

 

If you are having technical issues with our Windows product, please do the following: 

Spoiler

If you haven’t already done so, please run the Malwarebytes Support Tool and then attach the logs in your next reply:

NOTE: The tools and the information obtained is safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

  1. Download Malwarebytes Support Tool
  2. Once the file is downloaded, open your Downloads folder/location of the downloaded file
  3. Double-click mb-support-X.X.X.XXXX.exe to run the program
    • You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.
  4. Place a checkmark next to Accept License Agreement and click Next
  5. You will be presented with a page stating, "Get Started!"
  6. Click the Advanced tab on the left column

    mbst_get_started.jpg
     
  7. Click the Gather Logs button

    mbst_advanced_gather_logs.jpg
     
  8. A progress bar will appear and the program will proceed with getting logs from your computer

    mbst_getting_logs.jpg
     
  9. Upon completion, a file named mbst-grab-results.zip will be found on your Desktop. Click OK

    mbst_log_saved_desktop.jpg
     
  10. Please attach the file in your next reply. Before submitting your reply, be sure to enable "Notify me of replies" like so:

     notify me.jpeg  

Click "Reveal Hidden Contents" below for details on how to attach a file:
 

Spoiler

To save attachments, please click the link as shown below. You can click and drag the files to this bar or you can click the choose files, then browse to where your files are located, select them and click the Open button.

mb_attach.jpg.220985d559e943927cbe3c078b
 

One of our experts will be able to assist you shortly.

 

If you are having licensing issues, please do the following: 

Spoiler

For any of these issues:

  • Renewals
  • Refunds (including double billing)
  • Cancellations
  • Update Billing Info
  • Multiple Transactions
  • Consumer Purchases
  • Transaction Receipt

Please contact our support team at https://support.malwarebytes.com/hc/en-us/requests/new to get help

If you need help looking up your license details, please head here: https://support.malwarebytes.com/hc/en-us/articles/360038523934

 

 

Thanks in advance for your patience.

-The Malwarebytes Forum Team

 

Link to post
Share on other sites

1 hour ago, TigerByte said:

any and all help are greatly appreciated

We need to get information from this machine in order to have the proper detail to help you forward.
 NOTE: The tools and the information obtained is safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

Please do the following so that we may investigate this issue:

  1. Download and run the Malwarebytes Support Tool
  2. Accept the EULA and click Advanced tab on the left (not Start Repair)
  3. Click the Gather Logs button, and once it completes, attach the zip file it creates on your desktop to your next reply

Thanks

Link to post
Share on other sites

  • Staff

Are you able to access your cameras if you disable just the Web Protection component in Malwarebytes?  What about if you disable just the Ransomware Protection component?  It is important to narrow down, if possible, which component(s) of protection is/are causing the issue.  Please try disabling each protection one at a time, waiting about 30 seconds to allow the protection component to finish unloading itself, then try accessing the cameras to see if it works.  You can disable each by right-clicking the Malwarebytes tray icon in the notification area near the system clock and clicking on the name of each protection component then clicking Yes when prompted by User Account Control.

I also noticed in your logs that it shows that UAC is not set to its defaults.  Malwarebytes, like most other modern Windows applications, is designed to be fully UAC compatible and compliant, and this also means that if UAC is disabled it could cause unforeseen issues when installing and using Malwarebytes.  I would strongly advise resetting UAC to its defaults, not only for application compatibility, but especially for security of the system.  Instructions on restoring UAC to its defaults can be found in this article.

Here is the UAC setting from the logs:

UAC Settings
==================================
EnableLUA:                      On
Consent Prompt Behavior Admin:  Off

With all of that said, if the cameras use IPv6 for communication on the network then it might be a problem with the Web Protection component as there is currently a known issue which some users encounter with IPv6 connectivity that is being investigated by the Malwarebytes Developers.  It is also possible if the camera recording software is writing a lot of data to disk and deleting a lot of data as well (to manage space etc.), that the Ransomware Protection component's monitoring is interfering with the cameras' software.  If this is the case then disabling Ransomware Protection should allow the cameras to work and likewise, excluding the appropriate process that is doing all of the writes/deletes should eliminate the issue as long as they are excluded from detection as ransomware (an option when creating exclusions).

I hope this helps and that this issue can quickly be resolved.

Thanks

Link to post
Share on other sites

Hi..

Cameras work only when all 4 components are disabled. I tried disabling one at a time and it was a no-go.

the UAC settings have always been like this but the problem with the camera viewer started only about 2 weeks ago. I will adjust the UAC settings to default as per your recommendation.

 

thank you.

Link to post
Share on other sites

  • Staff

What about 2 at a time?  Did you try disabling Ransomware Protection and Web Protection?  What about self-protection, which isn't available in the tray's context menu but only found under the advanced startup settings in Malwarebytes?  Does it work if you disable all 4 but leave Malwarebytes running, or do you have to fully quit Malwarebytes to get it to work?

Link to post
Share on other sites

  • Staff

Excellent, sounds like progress to me :)

Now lets proceed with fixing this, shall we?  Please begin by excluding the entire folder where your camera software is stored.  I'm guessing somewhere under C:\Program Files or C:\Program Files (x86), but I don't know for certain.  Next, do the same for any other folders it writes to on a regular basis such as its data/temp folders (it likely uses one or more for storing clips in real-time as well as any long term recordings it is configured to retain).  I don't know enough about the software to tell you where these would be, though I could probably come up with a list of probable locations, but lets try to make it easy.

With Ransomware Protection disabled, run Process Monitor and look to see what folder(s) your camera software is interacting with, then check the paths/folder names and contents of the folder(s) to verify that they belong to the camera software, then add those folders as exclusions from detection as ransomware in Malwarebytes (this option must be selected as there are multiple types of exclusions in Malwarebytes even though there is a single list in the interface).

You can get a copy of Process Monitor here.  It is a Microsoft Sysinternals tool used for monitoring system and application activity (such as reads, writes, deletes etc. to files, folders and the registry) and if you configure a filter in Process Monitor to show only entries from your camera software's process, it should quickly show you where the software is doing its work (though the camera software must be running and working for them to show up in Process Monitor).

You'll find details about using Process Monitor here if needed.  If you need further help just let us know and we can provide more detailed instructions.

Thanks

Edited by exile360
Link to post
Share on other sites

  • Staff

Excellent, sounds like a plan.

Good work on figuring out the thing with Ransomware Protection.  I know these kinds of issues can be a real bear to track down, so I'm glad you didn't give up on finding which module was at fault.  Now that we have that information fixing this should be much easier.

I will also be reporting this compatibility issue with your camera software to the Product team so that they may work with QA and the Developers to hopefully correct this issue so that in the future no exclusions or special steps will be needed for users of such applications.

Thank you for taking the time to report this and for allowing us to assist you.

Link to post
Share on other sites

  • Staff

Hi @TigerByte,

When you run Process Monitor, could you save the results to a log file and provide us with a copy, please. This will help us determine if what you're experiencing is a known issue or not.

You can find instructions for saving a log in the following article:
https://support.malwarebytes.com/hc/en-us/articles/360039025073-Use-Process-Monitor-to-create-real-time-event-logs

Thank you!

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share

  • Recently Browsing   0 members

    No registered users viewing this page.

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.