latest Win10 Version Interference w\ AHIII

[Pudgie]

After thinking it thru I think that, since I wasn't using the game client for quite some time the OS decided that AHIII was a dormant\dead process so when I tried to run it back in late Feb\early Mar the game needed to patch itself so the OS was going into protect mode to stop a "rogue\dead" process from "infecting" the OS so Windows tagged the AHIII game client as a potential untrusted process so has tried to stop it from downloading any files when the AHIII processes called the AHIII servers for any type of files by tying up the TCP port that it saw the AHIII servers trying to use to gain access to my box.....which was TCP port 80.

Does make some sense of it all but is a bear to track down as there is no visible trail(s) left to follow.......leaves no dialog warning, neither from the OS outside of the 1 given when trying to patch the game or from AHIII as the game client hasn't physically failed so no .dmp files generated.

The generated warning dialog box is strictly a MS Windows design graphic thus was a clue to me that the issue was Windows related but didn't know how it was until now.............

Too much thinking gives me a headache now so I'm gonna shut it down for a while (Mrs. Pudgie has also instructed me that I have to go get her some junk food to eat so I need to stop this & attend to her needs...........you know what they say......happy wife, happy life.... ).

 

[Arlo]

....you know what they say......happy wife, happy life.... ).

Sage wisdom. 

[The Fugitive]

Update:

1st off, I got sidetracked by Mrs. Pudgie this morning so I got delayed from going outside to start work on my Stang but this issue was still buzzing around in my head so I got back into troubleshooting & I think I have now caught the culprit...........after going thru a little more Networking 101 training....... :

Completely off topic, but what kind of "Stang" were you working on?

I have a 99 that I like to mess around with. I dont have a lot of money to throw at her, but what little time I have goes to all those little things.

[Pudgie]

Completely off topic, but what kind of "Stang" were you working on?

I have a 99 that I like to mess around with. I dont have a lot of money to throw at her, but what little time I have goes to all those little things.

(Image removed from quote.)

This 1 attached below:

That's a nice New Edge you got there!

 

 

[The Fugitive]

This 1 attached below:

That's a nice New Edge you got there!

 

 

Very nice!   

[Pudgie]

Update:

This issue is a very tough nut to crack as I can't find the reason\source as to why Win 10 would suddenly latch onto the AHIII client software & block all inbound IP connections to it so that I can kill it.

Looking at active connection sequencing listings captured thru Command Prompt "netstat -abf" right after making attempts to run AHIII I can clearly see the OS tie up TCP port 80 to ntwk.MSN.net (Win 10 telemetry) right after starting up the game (when you sign in) & will not release the port until the game is exited.
I have gone into Windows Firewall in the inbound rules & enabled a rule to force TCP port 80 access open to all processes, set it, saved it, made sure that it was active (should have been immediately) along w\ the already existing rules to allow AHIII full access thru the firewall then tried to run the game w\o success, verified thru Command Prompt that the OS was still blocking TCP port 80 access to AHIII then go back into Windows Firewall only to see that the OS had completely removed the very rule that I had just put in!

I then went into Windows Firewall properties, Private Network Profile & reset the outbound connections from the default of Allow to Block (inbound is set default to block) so the firewall will block all outbound\inbound connections unless they were set up in the rules to allow passage then tried to run MS Edge & Windows Update to test......they got blocked so I knew that AHIII would get blocked as well (even though rules were set in both whitelists to allow the game free passage) but I wanted to see if this would also block the OS from attacking AHIII. Ran the game & got the same results.....looked at the connection listings in Command Prompt & saw that AHIII was not blocked on any outbound requests or saw any IP outbound requests from the OS trying to tie up port 80 but the port was still blocked to inbound traffic even w\ MS Edge set up in the inbound rules rules to allow passage thru firewall AND even though I had set up another rule in outbound rules to force open passage thru port 80 (this time the OS didn't remove the rule I had made) so the OS just summarily blocked TCP port 80 access regardless of the firewall rules selected unless the rule in the Private Network Profile was reset back to Allow....then all would return back to normal but the OS would then start individually blocking the AHIII client access to port 80 again so I know that the issue is strictly centered within the OS but have no idea of resolution.....have scoured thru the Internet for any inkling of info into what is going on here w\o any success to date. The only thing I haven't tried to do yet is to download\install Windows IIS (not available natively in Win 10 Home), activate it to take this over then see if all will go thru then...........

I have no idea as to why\how Windows got such a hard on for trying to stop AHIII from inbound comms on my box & this is not privy to vers 2004 as I was experiencing this issue 1st under vers 1909 & whatever it is it made it thru a full on Windows reinstall of 2004 using the Media Creations 2004 tool. For giggles I moved the game folder from my E:\ drive to the C:\ drive where the OS resides to see if by doing this the OS would stop blocking it when the game was ran then executed the game from it's own .exe files within the C:\ game folders.....nope, the OS kept blocking access to TCP port 80 & this is all w\ my 3rd party WebRoot SecureAnywhere AV completely removed....only using the native Windows 10 Security suite which is showing & tested to be fully functional & is not giving any indications of malfeasance so at this time I'm stumped but not broken yet as I'm determined to not give in yet so will keep pecking at it.

The key to unlocking this is in here somewhere.......

This is where we are at this time.

This sure is starting to smell of some kind of potential infection\bug attack as well but all scans so far keep showing no threats...........

 

Very nice!   

Thanks Fugi.

 

[Bizman]

Are you sure you could root Webroot out entirely?

There seems to be a dedicated removal tool but sometimes even the special tools may leave leftover directories. There's tools that can find every Anti-virus and provide removal tools. I've recently found https://antivirus-removal-tool.com/ whose Search function revealed leftovers from programs that already were first uninstalled the normal way and then cleaned with the dedicated tools. The search results made removing the remaining files and folders manually quite an easy job. Unfortunately it doesn't find registry entries, though.

For entirely removing each and every instance of any program there's tools like Revo Uninstaller that start with the normal uninstall and continue to track both remaining folders and registry entries. In your case that would require reinstalling Webroot to enable a thorough uninstall with Revo or the likes.

[TequilaChaser]

TC makes NOTE!

Do not  attempt to post any comments, respondences or suggestions first thing in the mornings right after waking up and before at least drinking a mug of if not  2 of coffee.....

I just  messed up,  hit the  wrong  button and lost roughly 30 to 45 minutes of  response to your current post/ reply,  Pudgie

Will  get me  some  coffee and  try to respond again  later....good grief....lol

[Pudgie]

TC makes NOTE!

Do not  attempt to post any comments, respondences or suggestions first thing in the mornings right after waking up and before at least drinking a mug of if not  2 of coffee.....

I just  messed up,  hit the  wrong  button and lost roughly 30 to 45 minutes of  response to your current post/ reply,  Pudgie

Will  get me  some  coffee and  try to respond again  later....good grief....lol

I know the feeling!

 

It's all good!

 

Are you sure you could root Webroot out entirely?

There seems to be a dedicated removal tool but sometimes even the special tools may leave leftover directories. There's tools that can find every Anti-virus and provide removal tools. I've recently found https://antivirus-removal-tool.com/ whose Search function revealed leftovers from programs that already were first uninstalled the normal way and then cleaned with the dedicated tools. The search results made removing the remaining files and folders manually quite an easy job. Unfortunately it doesn't find registry entries, though.

For entirely removing each and every instance of any program there's tools like Revo Uninstaller that start with the normal uninstall and continue to track both remaining folders and registry entries. In your case that would require reinstalling Webroot to enable a thorough uninstall with Revo or the likes.

Hey Biz thanks for the link! Yeah I already know the registry will still contain WebRoot entries.....plan to deal w\ that later. While I had WebRoot installed it never showed any instances of attacking\quarantining AHIII as a rogue actor (had the game set up in it to allow it clear passage for several yrs w\o issue prior this current issue cropping up) but I also know that it was integrated w\ Win 10 Security as well (WebRoot used the Windows Security firewall inbound connections whitelist to monitor inbound traffic so it only monitored outbound connections since WSF allowed all outbound connections passage by default so in essence both Win 10 Security & WebRoot were active together (WebRoot was performing the AV while WS was performing mostly malware detection).

Now I have Win 10 Security doing it all....have used it to run full scans 2 times & it has found nothing on any of my drives & thru tracking the active connections IP traffic trails after attempts to run AHIII & failing I can consistently see as soon as I sign in to AHIII (game sends outbound IP to AHIII servers to ACK me) I see rogue outbound IP addresses that won't identify themselves (why I was invoking -f to convert IP to HTTP) that are tying up TCP port 80 to MSN servers (traced all the rogue IP's back to ntwk.MSN.net...Win 10 telemetry) & hold it (established) so that AHIII servers can't download any files\connect to my box (inbound traffic)......will allow the AHIII client to send all the outbound it wants to the AHIII servers (can see all those) as they're going out\being received on other ports outside of TCP port 80 & won't release it for AHIII until I exit the game (AHIII client send outbound IP to AHIII servers to close\disconnect) then this rogue IP will close itself & release TCP port 80. When Hitech had me to go thru my web browser then access the same AHIII servers & downloaded the very same files (removes AHIII client as the front man & uses MS Edge instead) to the client then all functioned as normal so he knew the TCP 80 port was being blocked by some IP address other than AHIII at my end but it would not block other IP's (like my browser) so the only IP addresses that are getting blocked are inbounds from AHIII servers AFTER whatever it is doing it is alerted on outbound IP traffic from sign in from AHIII client on my box to htcgm.hitechcreations.com AHIII server.....

I can't see WebRoot AV doing that (if it did it would have blocked the outbound AHIII traffic as the WSF was set to allow all outbound IP traffic by default & it never did this as AHIII was set to pass thru & the outbound IP tracking confirms this....also for Win Security firewall as well)....but I can see either Win 10 itself thru some Win Update or some masked virus\trojan residing in Win 10 doing that & either way it points to Win 10 from my vantage standpoint.

The question is which 1 is it?

I know when I change the outbound action in WSF private profile from allow (default) to block (blocks all outbound traffic except what is allowed thru the outbound whitelist rules) w\ AHIII set up in the WSF outbound whitelist rules to pass thru then tested MS Edge & Win Update 1st to see if they got blocked to determine if Windows may also be blocked to ntwk.MSN.net. Then I tried to run AHIII as normal to see if the rogue IP's got blocked on the outbound & AHIII's outbound went thru......all the rogue outbound IP addresses got blocked (so I know they don't exist in the outbound whitelist rules & Win Update doesn't either) but all AHIII's outbound IP addresses went thru as normal but got blocked on inbound the same as before but the seeing of the rogue IP addresses being blocked along w\ Windows Update on outbound traffic points to the 2 being related along w\ the IP trace routes to MSN networks thus the source of this issue is coming from Win 10 itself........

Now what I might do (if Windows lets me do it) at some point in time is to run the Media Creations 2004 tool again to do another reinstall of Windows 10 2004 to see if it can clean up the registry on this pass (had WebRoot installed on the last pass) before I resort to using a 3rd party app. I do like this link you sent to this app as it doesn't need to be installed to run so that's a plus (std Biz operations....  ).

I was trying to see if I could fix this w\o having to use any 3rd party apps.......I know this can be a heavy lift but it is also a good way to learn how to get around thru Win 10 & to use it's many features........using the Internet to find any guiding info needed if\when I ran into something that I wasn't familiar with before proceeding to mess w\ it.

For once I want to isolate the source of the issue before resolving it so that the info can be gleaned to help others (like Hitech) if other players run into this somewhere down the road......... To date I've found nothing out on the Internet pointing to this specific issue I have so am going into this kinda blind............

Since I'm retired now I got the spare time (especially since COVID-19 came along) to take this on............

PS--Forgot to mention that I have ran her thru DISM along w\ sfc /scannow a couple of times since & all comes back clean w\ no errors found or fixed......

 

[100Coogn]

Pudgie, would a clean install of Windows be plausible for you?  Maybe just a Windows 10 Reset, if you want to try to save any data you may have.

Coogan

[Pudgie]

Pudgie, would a clean install of Windows be plausible for you?  Maybe just a Windows 10 Reset, if you want to try to save any data you may have.

Coogan

Hi 100Coogn,

Done done the reinstall\reset once already using the Media Creations 2004 tool but that was before I blew off WebRoot SecureAnywhere AV....why I mentioned to maybe try it again to see if I can save myself the hassle of a full blown clean reinstall.

Saving that 1 for the absolute last resort.

 

[100Coogn]

Hi 100Coogn,

Done done the reinstall\reset once already using the Media Creations 2004 tool but that was before I blew off WebRoot SecureAnywhere AV....why I mentioned to maybe try it again to see if I can save myself the hassle of a full blown clean reinstall.

Saving that 1 for the absolute last resort.

 

I was hoping that would of reset something dealing with the internet settings.
Hope you get it straightened out, without too much hassle.

Coogan

[Pudgie]

I was hoping that would of reset something dealing with the internet settings.
Hope you get it straightened out, without too much hassle.

Coogan

Yeah hoping for the best.

I'm being punished for not playing the game for so long due to spending too much time messing w\ my Stang & hanging out on the Mustang forums so y'all couldn't be shooting me down & pad your scores!

My Stang has a joystick & pedals in it too...........

 

 

[Vulcan]

Now I have Win 10 Security doing it all....have used it to run full scans 2 times & it has found nothing on any of my drives & thru tracking the active connections IP traffic trails after attempts to run AHIII & failing I can consistently see as soon as I sign in to AHIII (game sends outbound IP to AHIII servers to ACK me) I see rogue outbound IP addresses that won't identify themselves (why I was invoking -f to convert IP to HTTP) that are tying up TCP port 80 to MSN servers (traced all the rogue IP's back to ntwk.MSN.net...Win 10 telemetry) & hold it (established) so that AHIII servers can't download any files\connect to my box (inbound traffic)......will allow the AHIII client to send all the outbound it wants to the AHIII servers (can see all those) as they're going out\being received on other ports outside of TCP port 80 & won't release it for AHIII until I exit the game (AHIII client send outbound IP to AHIII servers to close\disconnect) then this rogue IP will close itself & release TCP port 80. When Hitech had me to go thru my web browser then access the same AHIII servers & downloaded the very same files (removes AHIII client as the front man & uses MS Edge instead) to the client then all functioned as normal so he knew the TCP 80 port was being blocked by some IP address other than AHIII at my end but it would not block other IP's (like my browser) so the only IP addresses that are getting blocked are inbounds from AHIII servers AFTER whatever it is doing it is alerted on outbound IP traffic from sign in from AHIII client on my box to htcgm.hitechcreations.com AHIII server.....

A couple of points.

Windows firewall isn't worth much as a protection goes. If you have a router (or hardware firewall) just turn it off.

Your stuff about networking ports don't make a lot of sense (technically. For example you talking about something holding onto port 80... it just doesn't work like that. Don't take this the wrong way but you might be confusing yourself around this and making it harder to diagnose.

If AH is failing to connect to HTTP @ HTC, then you have either a proxy in the middle somewhere or a security app is blocking (possibly windows firewall). A proxy could be webroot (like their secureanywhere) or some sort of malware.

[TequilaChaser]

If AH is failing to connect to HTTP @ HTC,(edited/added by TC: or if AH is failing to connect to port 80) then you have either a proxy in the middle somewhere or a security app is blocking (possibly windows firewall). A proxy could be webroot (like their secureanywhere) or some sort of malware.

I did a small edit/inc;usion to Vulcan's above post

while I haven't bothered to try and remember word for word of my lengthy reply yesterday, Vulcan's post #43 above refreshed my memory a tad...

You have posted that you have had been using (together/combined 3 to 4 Firewalls) :
#1- an ADSL modem/router with it's own built-in firewall, then you also are using
#2- native Windows 10 Security suite, (does this include Windows Defender? or is that a 4th app?)
#3- WebRoot SecureAnywhere AV

and you have also posted that even with Windows Defender disabled & WebrootS-A & AV removed, you were still experiencing problems with port 80 being blocked or tied up to where AH3 could not access it...

If possible, and if it is, have you tried placing AH3 in the DMZ on both your Windows 10 Firewall as well as your DMZ on Webroot and on your ADSL modem/router.... to where it circumvents and sidetracks most of the extra tightened down security features each separate firewall might have?

one more thing before I got to log for morning Bible Study!

if it's showing it is a windows 10 telemetery thing blocking/tien' up port 80 on AH3.... have ou thought about running one of the apps Skuzzy has listed for Windows 10 from years ago, on how to turn that telemetery stuff off and make it stop?


just some thoughts, best of luck, got to go am running late

Have A Blessed Day!

TC