Site Root

Forum Post: Re: Question: Ceton InfiniTV 4 with Time Warner Cable Card

erkotz — Thu, 25 Apr 2013 23:50:00 GMT

Most likely these TAs aren't actually bad, but they are mis-provisioned.

Forum Post: No Infinitv found and WMC

bad caddy — Thu, 25 Apr 2013 16:58:00 GMT

I have a Ceton InfiniTV 4 USB installed on a PC used in htpc configuration that worked intermittently for about a month before eventually not responding anymore. At first I was having severe pixelation, with the device and WMC both saying they were getting weak signal even though the Comcast HD stb's I still had operated perfectly. Comcast came out 4x to try to make certain all was well on their end. Ceton support kept shooting 'fixes' at me that solved the pixelation trouble but the device still wouldn't hold onto the channels. With increasing frequency I was forced to reinstall the channels because WMC kept detecting the CableCard over and over no matter how many times I went thru the WMC set-up process. No I get the message "No InfiniTV Found" on the Ceton Diagnostic Tool and WMC doesn't see the device either. I've installed Ceton recommended Microsoft "hot fixes" for WMC and my PCs USB ports. A host of driver upgrades to all the devices on every computer. I changed the power settings so the pc connected directly to the device and router/modem won't sleep. I removed all the PCs from the Homegroup network set-up just in case. I forget everything I've tried the list is very long. Nothing works.

I have replaced the CableCard 3x, the cable modem 1x, and trying my 2nd InfiniTV USB device. All but the first CableCard on suspicion. I've tried it on three different Windows 7 64-bit machines running quad-core Intel chips, two are running 8gb of ram and one is running 4gb of ram. One uses MSE, one uses AVAST and another uses Norton 360. I was hoping a remote take over on the Norton 360 machine by a Norton tech might provide some insight on the network issue but he was as baffled as I am. I have the same problem on all machines. All the machines are using coax ethernet (MoCa) and I have reliable 25gb+ internet speeds from a Comcast Arris cable modem (it has CVoip). At first I had luck uninstalling then re-installing the Ceton software and with every 'fix' I got thru Ceton support things got worse. I RMA'd the first device and just installed the new one about 6 hrs ago. Same result.

Windows Network Diagnostic on all the machines report that the Local Area Connection for Ceton InfiniTV USB Network Device has an invalid (I'm assuming non-static) IP address and the troubleshooter cannot repair the trouble. Clearly the Ceton device has no received IPv4 internet connection/traffic and miniscule sent traffic. Mind you three different machines from two different manufacturers running Windows 7 HP 64 and different AV, all report this identical issue. I'm still working with Ceton support which is a true hassle over email.

I'm all but certain there is a common network settings problem relating to the InfiniTV device itself as Windows Network Diagnostic is agreeing, but I can't figure it out. You would think the device would show up on a network map but it doesn't.

Does anyone have a definitive fix for this issue?

Forum Post: Re: Guide Tool Re-number / re-map Channels

barnabas1969 — Thu, 25 Apr 2013 15:30:00 GMT

You need to merge the two channels. To do this in GuideTool, follow the instructions in the post linked below:

experts.windows.com/.../401455.aspx

Then, you will need to assign the tuner priority in Media Center. Here's how:

Open the Guide in Media Center, scroll to the newly merged channel, move left to select the channel name/number in the left column of the guide. Click on the channel number/name. Now, I can't remember exactly what the menu option says, but it's something like "Edit channel". Choose this. Then, choose "Edit Sources". Here, you will be able to move sources up and down in priority. Make the HD channel the top priority, and the SD channel the bottom priority (or disable it by unchecking the box) for each of your tuners.

Save the settings.

Forum Post: Re: Microsoft please fix the 29/59 bug!

mkanet4 — Wed, 24 Apr 2013 21:07:00 GMT

Richard, no offense, but it seems all you did was "try" to argue semantics. Whether it should be called a bug or not. Seriously? I agree though, the 29/59 framerate bug could have been named better. It looks like you didnt not understand what I meant by mixed soft/hard telecine content; if you did, you wouldnt spent all the effort trying to explain what "mpeg2 headers" are. You might want to read up on what soft/hard telecine content is; and, re-read my original post. I also put a more detailed explanation of what's going on "under the hood" below.

Older GPUs like my old GT8500 dont bother IVTCing the hard telecine portion of the mixed content (59.940 interlaced fields per second); so, it only has to worry about deinterlacing it to 29.97fps. These older generation GPU without IVTC capabilities can easily do this without worrying about switching IVTC on and off. The content still switches between 23.976fps and 29.97fps; but, that's still okay. With newer display cards, they do IVTCing of hard telecine instead of deinterlacing in the hardware; reconstructing perfect progressive frames at 29.97fps. They don't do decimation (removing of duplicate frames); so, the "hard" telecine portion of the content stays at 29.97fps instead of reducing it to 23.976fps. IVTCing of hard telecine content in itself isn't the cause of the problem; its when trying to turn IVTC on and off when switching between hard and soft telecine mixed mode content; which apparently most GPU with IVTC dont do too well. It's not a matter of stronger or weaker GPU. You're right that adding additional post processing features such as dynamic contrast does add to the switching delay; which can exaggerate the stuttering effect. I haven't seen any ATSC broadcasts with this type of mixed mode content; at least not in my area.

It is possible to fix this issue by IVTCing via software; instead of leaving it up to the GPU. This can be done one of two ways:

1. dscaler mpeg2 IVTC mod decoder It's really old; but still does the job. The only problem is it only has bob/weave deinterlacing. The great thing about this solution is it not only handles IVTC correctly, it also performs the addition decimation step to convert the full TV recording to a stable/consistent 23.976fps without any framerate change or deinterlacing. With Reclock, you can go one step further by by restoring the original 24.000fps camera framerate of the full TV show or movie without any quality loss. You can even play it back on a TV at 24.000fps/24.000Hz. I know this, because this is what I currently do now. The only drawback to this method is there's no deal deinterlacing in this mpeg2 decoder; just basic bob or weave. So, for video based content; such as Jay Leno TV show, News, etc... it will lose data when blending. I tried to convince the creator of dscaler to add deinterlacing; but, unfortunately he lost interest a long time ago.

2. Use MadVR video renderer instead of EVR. With this option you get best of both worlds, both full deinterlacing for video content and IVTC. The only downside to this is Windows Media Player's builtin player can't use a different video renderer; so, playback needs to be done via an external player such as MPC-HC. So, for practical purposes, this isn't even a real option for anyone.

The downside to both solutions is they can only handle content without DRM content protection restrictions. For people who use R5000 TV tuners with SageTV (such as me), they can at least use the first solution (dscaler mpeg2 IVTC decoder). I use R5000 TV tuners + sageTV. However, sageTV cant use an external media player like the way Windows Media Center can. Plus, I wouldn't want that anyway since I'd lose all video overlay/OSD effects. That's how I was able to witness this problem long before it was ever reported by people using cablecards on Media Center.

This issue does need to be addressed by display card manufacturers. It's too bad they dont test this kind of content before releasing newer generation display cards.

[quote user="richard1980"]

[quote user="mkanet2"]Actually, it looks like you have it backwards richard; and, completely wrong information.[/quote]

What part is backwards/wrong? I understand this issue completely, perhaps better than most.

[quote user="mkanet2"]The actual problem was caused by introducing additional hardware decoding capabilities (more advanced IVTC/deinterlacing) in newer display cards when trying to handle mixed soft/hard telecine mpeg2 encodings. It was NOT because of a "weak GPU"; in fact, it was clearly the other way around.[/quote]

It has been pointed out several times that the actual problem is with the content. Specifically, the MPEG headers contain information about each picture in the stream, and that information is what determines whether a specific picture should be treated as interlaced or progressive. The switch from processing content marked as interlaced to processing content marked as progressive is what causes the various symptoms, such as stuttering, screen flashing, and screen blanking. Do not confuse the symptoms with the problem.

As for the words "weak GPU", I don't know how else to describe it. For this specific issue, the stuttering is the result of dropped frames; the frames are dropped because some GPUs can't change the state of the deinterlacer fast enough to keep up with the incoming video stream. Additionally, it has been proven that a GPU may stutter when certain post-processing options are enabled, but doesn't stutter when those post-processing options are disabled. It has also been proven that there are certain GPUs that are powerful enough to play the 29/59 content without stuttering, even with post-processing options enabled. So I don't know what you would call it, but when something isn't powerful enough to do what it is being asked to do, I call it weak. And clearly, there are many GPUs that are not powerful enough to play 29/59 content smoothly. Therefore, they are weak. How else would you describe it? Would you prefer I use the word "slow" instead of "weak"?

[quote user="mkanet2"]It actually takes relatively little GPU power to decode these videos; which is why any old school GPU/standalone STB can decode these video streams with no stuttering.[/quote]

Except that is not true at all. There are actually very few GPUs that are powerful enough to play the content smoothly.

[quote user="mkanet2"]Later down the road, another bug was introduced in the nvidia drivers which causes the "white-flash" symptom. Unfortunately, people on the forum started incorrectly referring to this as the "29/59 bug" as well; which caused a lot of confusion for many people.[/quote]

I think your definition of "29/59 bug" is what is incorrect. First, it's not a bug. WMC's reaction to the MPEG header flags is as expected. Second, as I stated above, the 29/59 issue is a problem with the content, and there are several different symptoms that are caused by this problem. You are saying that "29/59 bug" is the correct term to use to describe stuttering, when that is not correct. "Stuttering" is the correct term to describe stuttering. "29/59" just describes the frame rate change that can be observed from the "Debug: Presentation" screen in WMC. But don't stop there. What does it mean when the listed frame rate changes? It means the flags in the MPEG picture header are changing. And that is the root problem. Stuttering is not the problem. Stuttering is just a symptom of the problem.

[quote user="mkanet2"]Part of the reason the original problem still exists today is because of all the confusion introduced along the way. In fact, there's so much confusion now that people who have any kind of video stuttering under Media Center; even on local OTA ATSC channels, refer to their problem as the 29/59 bug! I have a feeling its going to be near impossible for vendors to fix the problem due to all the confusion introduced by newcomers. If I was trying to understand the original real problem (without seeing it), I would be confused too if I did a google search for "29/59 bug".[/quote]

I agree. And part of the problem is the discussions from the early days. "Stuttering" is a symptom of "29/59 content", yet there are tons of posts where people have incorrectly used the term "29/59 bug" to describe the stuttering. A more appropriate phrase would be "stuttering due to 29/59 content". Simply put, the symptom was mislabeled as the problem, and that mislabeling still exists today. One of my points has been that the symptom and the problem are NOT the same thing. People want the stuttering fixed, but they fail to see that stuttering is not the only symptom. As I explained to Carl, fixing the stuttering doesn't fix the problem. Specifically, when the header information that accompanies each picture doesn't actually match the picture, that causes the picture to be processed incorrectly. If you want to see for your own eyes, grab one of the GPUs that are known to play smoothly, and play Grimey's first Invention of Lying clip (see here). Pay specific attention to the windows and lettering on the building. You'll notice combing, and if you examine the MPEG headers, you'll also notice that the pictures are incorrectly flagged at the points where combing is evident. The incorrect flags cause WMC to send the wrong instructions to the GPU, which causes the GPU to process those pictures incorrectly. It doesn't matter if the GPU plays stutter-free, the content still isn't being processed correctly because the flags are still set incorrectly. I have repeatedly said that the only way to fix the problem with the incorrect flags is to go back to the entity that encoded the content, give them a technical explanation of what is happening, and try to get it resolved.

Even if we were to get to a point where the flags always match the pictures, it is still possible for the content to contain a mix of field pictures and frame pictures, and the rendering instructions could require changing the state of the deinterlacer in order to play the video correctly. And as you (should) know, not all GPUs are capable of doing this without dropping frames (which means there will be a visible stutter). And again, there is an answer to this. There are a few GPUs that are known to play 29/59 content without dropping frames (which means no stutter). Combined with the previous solution, this should result in perfect playback.

Unfortunately, there are people that don't like either of those answers. There are people that think there is nothing wrong with the content (and to be fair, it is entirely possible that nothing is wrong with the content they have seen, but Grimey's clips have been here long enough that there's really no justification in anyone denying the fact that the flags in the picture header are not always correct). Additionally, there are people that think there's nothing wrong with the GPUs, despite the fact that multiple people have stated that switching GPUs fixed the stuttering. The popular answer among those deluded people is to blame Microsoft, and they use faulty logic to justify their position (I'm reminded of all the people that use "it plays smoothly on a cable box" as justification, despite the fact that the cable box has a completely different graphics processor than their computer, or people that say "it plays smoothly in (insert application here)", despite the fact that the application they reference utilizes the CPU for deinterlacing, not the GPU, or that it ignores the flags altogether, rendering truly mixed content incorrectly.)

Here's a perfect example of somebody that thinks there's nothing wrong with their GPU:

[quote user="Quatrix"]

[quote user="richard1980"]There's more to this issue than just stuttering on weak GPUs.[/quote]

[quote user="richard1980"]Expecting WMC to run well on poor hardware is foolish.[/quote]

Sorry, but blaming this on "weak" hardware is ridiculous. The 29/59 stutter is still obvious on a $1,000 GTX 690, the fastest GPU (actually dual GPU) available.

[/quote]

If your $1,000 GTX 690 is the fastest GPU available, why are other GPUs able to switch the state of the deinterlacer faster than the GTX 690? Clearly the GTX 690 is not the fastest GPU available when it comes to switching between interlaced processing and progressive processing.

[quote user="mkanet2"]even on local OTA ATSC channels[/quote]

If you are implying that 29/59 content does not exist on ATSC broadcasts, you are incorrect. I have seen the 29/59 issue on my ATSC NBC broadcast. Again, this goes back to the early days, when it was thought this issue only occurred on premium channels, when in reality, it occurs on non-premium channels as well.

[quote user="mkanet2"]If I was trying to understand the original real problem (without seeing it), I would be confused too if I did a google search for "29/59 bug".[/quote]

As I pointed out earlier, it's not a bug, so obviously any search for a bug would turn up BS results. Luckily there is a wiki that gives a "technical explanation for dummies" here.

[/quote]

Forum Post: Re: DVD Playback and Storage Spaces

Rumblebee5161 — Wed, 24 Apr 2013 15:31:00 GMT

I had looked at that thread as well. The same solution was proposed there about creating the storage pool in Server 2012. I will need to scrounge up so extra drives to try this out.

Forum Post: Re: Net User ID and Net Password - Log in Fail?

Tony 211 — Wed, 24 Apr 2013 14:31:00 GMT

erkotz,

Thanks again. I'll make the changes and let you know if they help.

Forum Post: Re: MC-TVConverter - converting WTV, DVR-MS, MPEG and TS

LaurieH — Wed, 24 Apr 2013 14:24:00 GMT

Hi @Hundi - I was using the MPEG2 HQ. On examining the files they have a 6 channel audio stream which I assume is 5.1 surround and I guess my TV does not support that! I'll fiddle with the profiles and probably try the DVD Profile too. I'm sure I'll get it sorted OK..

Cheers for now!

Forum Post: Re: Incomplete Recordings

Pj1 — Wed, 24 Apr 2013 05:57:00 GMT

Hey... me too! I have Win7 Pro with Hauppauge WinTV-HVR-2250 (Software WinTV v7.2 Version 2.0 on CD). I have not updated this since I got my computer back in Nov 2010. These 'split' recorded programs have been happening for many months. I do not remember how far back this started, anymore. I do not think it was always like this. It is somewhat rare but often enough that it bugs me.

I have always had WMC7 lockup on me since day one. I usually get away with playing a few recordings at time, then close/restart WMC if I will play more recordings. The other day, I removed the WinTV software for the first time (rarely used it). While it is too early to say the freeze/lockups have stopped, I have played 7 or 8 recordings in a row, so far. (I think it is an all-time record!) Ha!

However, when I did a fresh scan of channels (Analog & Clear QAM setup) the other day, all but a few Clear QAM channels did not show up. Was it due to removing the WinTV software? (I will reinstall WinTV, updated, at some point.)

For now, I just manually added all of the Clear QAM channels (...plus mapping and listings). I will keep an eye open for any more 'split' recordings. I do not know about the hotfix... it appears to be for only not being able to play or record - - - not this SPLIT recording problem.

Forum Post: Re: WMP 12 Script error when trying to manually get or update Album info

rasta11 — Wed, 24 Apr 2013 01:52:00 GMT

I solved the problem by enabling several add-ons in ie 10, including Windows Live ID sign-in helper.

Wiki: Experts Community Wiki

Anonymous — Wed, 24 Apr 2013 00:56:00 GMT

Tips, Tricks and knowledge from Windows experts

Wiki Page: Windows Defender on Windows 8 - Introduction and Frequently Asked Questions

Dr. Strangelove — Tue, 23 Apr 2013 17:56:00 GMT

Introduction to Windows Defender on Windows 8

Windows 8 was released on October 26, 2012. One of the notable features about this OS release from Microsoft is that it contains integrated anti-malware protection known as Windows Defender.

Previously, a “Checklist for installing Microsoft Security Essentials” applied to Microsoft Security Essentials (MSE) on Windows XP, Windows Vista, and Windows 7. With the release of Windows 8 (W8), this checklist is not entirely applicable, as Windows Defender (WD) is integrated with Windows 8. However, some portions of this checklist are still applicable (and are referenced in the discussion/topics below). Additionally, there is confusion concerning the name “Windows Defender”, as that product name has had multiple implementations. Windows Defender, as discussed in this document, APPLIES ONLY TO WINDOWS 8.

This document is specifically for Windows 8 64-bit, and Windows Defender as integrated into Windows 8. This document assumes the use of Internet Explorer and Windows Firewall. For 32-bit users, or those using a different browser or firewall, you will have to adapt any specifics. This document does not discuss Windows Server 2012, or any server product.

And, there is no discussion of Microsoft Security Essentials because MSE is not designed for, or supported on, W8.

Why was this document created? The purpose is to address various issues, concerns, and address frequently asked questions, regarding WD on W8, and to help you Protect your PC.

This document is divided into four sections:

SECTION 1: How do I get Windows Defender on Windows 8?
SECTION 2: Issues affecting WD on W8
SECTION 3: Frequently Asked Questions and General Concerns
SECTION 4: A well-protected system

With all that said, it is hoped that you find the information below helpful.

SECTION 1: How do I get Windows Defender on Windows 8?

There is no need, nor is it possible, to install WD on Windows 8. WD is integrated with Windows 8, protecting you from malware. Conversely, you cannot uninstall WD.

If you install a third-party anti-malware product, WD will be disabled. If you [properly] uninstall a third-party product, WD will be enabled.

Before we can do anything with Windows Defender, we need to know how to open it! To open Windows Defender, do the following:

Use the charms and search for Defender. Then, click on Windows Defender.

However, how you get to Windows 8 is the issue:

Upgrading to Windows 8: Previously installed anti-malware is a problem and can/will disable WD. Prior to upgrading, if you intend to use WD as your anti-malware protection, you must completely remove all previously installed anti-malware products (including MSE if installed). The list of anti-malware removal tools should be used to this end. Uninstall all previous anti-malware products, and use the appropriate manufacturer’s cleanup tool. Then, upgrade to W8. With a successful upgrade to W8, you will be using WD as your anti-malware protection.

New PC or fresh install of W8, with NO pre-installed third-party anti-malware product: There is no need to install any third-party anti-malware product. WD is there, protecting you. However, you can install a third-party anti-malware product. A successful install of such a product will disable, or should disable, WD. This is the correct behavior/procedure. The issue of having multiple real-time anti-malware products installed has been discussed many times. Regardless of what you have been told, or what a few will recommend, you cannot have more than one real-time anti-malware product installed. This is discussed in more detail later in this document.

New W8 PC with pre-installed third-party anti-malware: If your new PC came with a free or trial version of a third-party anti-malware product (i.e. Norton, McAfee, TrendMicro, etc.), and you want to use WD, you must uninstall and use that manufacturer’s cleanup tool, even if you never used or activated the third-party product. The list of anti-malware removal tools should be used to remove completely the third-party product. If your product manufacturer is not listed, go directly to their website to find their removal/cleanup tool. After removal, restart your PC. Also, you may have to enable [and restart] Windows Defender.

Reverting to WD: Reverting to WD after you have installed a third-party anti-malware product is possible. However, to do so, you must uninstall the third-party anti-malware product, and then use the manufacturer cleanup/removal tool as discussed above. After removal, restart your PC. Also, you may have to enable [and restart] Windows Defender. Once this is accomplished, WD is enabled and protecting you.

SECTION 2: Issues affecting WD on W8

What can affect WD on W8? Most issues with WD can be corrected by following the steps below:

Verify that you have removed all other real-time anti-malware products that were ever installed on your PC, including any free/trial products that were installed when the PC was purchased (i.e. Norton, McAfee, TrendMicro, etc.). Then, use the list of anti-malware removal tools to complete the removal of these products.
If you have installed Java, Adobe Reader, or any other “free” product, you may have been presented with the option to install a “free virus checker”, which is selected by default. If you were caught by this, and unknowingly/accidently installed this “free virus checker”, uninstall it and use the cleanup tool(s) in the list above. Note that these “free” downloads can also occur in products purchased by you. Your ISP may also provide an anti-malware product (and perhaps a firewall). Install these products ONLY if you do not intend to use WD and/or the Windows Firewall.
Verify that your PC clock is correctly set. If not, correct it.
Verify that you are up-to-date with the latest Service Pack and updates.
Verify that the Windows Firewall is on, and set to defaults. Remove any other firewall that may be installed and use the Windows Firewall. Third-party firewalls (as well as those included in some anti-malware products) can cause problems if incorrectly configured.
Verify that you are not using a proxy server. If you are using a proxy, configure it as per the instructions later in this FAQ.
Verify that you have “Install updates automatically (recommended)” selected in Windows Update.
In Internet Explorer, reset all security zones to default level.
Then, restart your PC.

If a third-party anti-malware product was installed, it disabled WD. If you want to return to using WD, and you have properly removed that third-party product, you may have to re-enable WD.

Use the charms and search for Defender. Then, click on Windows Defender.
Select Settings tab.
Check Turn on real-time protection (recommended)
Click Save changes
Click Update tab then Update button to have current updates downloaded and installed
You may also want to do a Quick scan by selecting the Home tab and then selecting Quick scan

If you are still having problems with WD, post a message in the community forum. To do so:

Note what version of WD you are using. Open WD, click on the “down pointer” to the right of “Help”. Then, click on “About Windows Defender”. Provide this information when asking a question in the Virus and Malware community forum.

SECTION 3: Frequently Asked Questions and General Concerns

The questions/topics included in this section are:

Can I have more than one real-time anti-malware product installed?
Having multiple real-time anti-malware products provides “layered-protection”, correct?
What is ELAM?
What if I rebuild/reinstall/recover my Windows PC from my manufacturer supplied media?
Does WD provide a registry cleaner?
How well does WD protect you?
How do I know if WD is really working?
Can I schedule when WD definition updates occur?
What if I leave my PC turned off for several days?
I do not understand WD’s definition updates.
How do I get definition updates and program upgrades?
What is the difference between a Quick scan and a Full scan
Will WD scan and update while my PC is asleep?
Can WD shutdown my PC once a scan is finished?
How do I schedule a scan with WD?
Where are WD Settings?
How do I temporarily disable Real-Time scanning?
Where are the WD desktop and tray icons?
How do I determine what version or build of WD I have?
How do I get support for, and provide feedback on, WD?
Can WD be used from the Command Prompt?
Where are the WD log files?
Can I use a proxy?
I cannot use my VPN.
Does WD scan email?
Does WD filter junk email?
Does WD include a Firewall?
Are there other scanning options/solutions/tools from Microsoft?
What about cookies?
How do I remove/release a file or program that is being quarantined?
Windows Backup and quarantined items
How do I backup my computer and data?
How do I control Startup programs?
Can I improve my startup performance?
How do I use the MS Community forums?
Are calls from Microsoft to remove viruses legitimate?
What if I get a Pop-up for one of those fake anti-virus products?
Can I use a cleaner like CCleaner or Advanced System Care?
Do I need JAVA?
What about Adobe Flash Player?

1. Can I have more than one real-time anti-malware product installed?

No. Having more than one real-time anti-malware product installed will compete with other anti-malware product(s), and can cause severe performance problems and system stability issues, and may limit the effectiveness of the products installed. Even if you attempt to have more than one product installed, with one active and another disabled, the disabled product will likely still have active components and/or drivers installed that will conflict with WD. The important issue here is that any other product with real-time scanning will conflict with WD (or any other real-time product).

However, you can have an on-demand scanner, such as Malwarebytes, installed. Malwarebytes offers two different scanners – one on-demand (free), and one real-time (paid). The on-demand scanner does not conflict with WD’s real-time scanning. Some users consider having one real-time product (e.g. WD) and an on-demand product (e.g. Malwarebytes (free)) a good combination on their system.

2. Having multiple real-time anti-malware products provides “layered-protection”, correct?

A few users believe that having more than one real-time anti-malware product installed provides “layered-protection”. This is incorrect. It is overlapping protection. Layered protection is good, overlapping protection is bad.

Since many/most anti-malware products available today provide protection for spyware, viruses, worms, Trojans, etc., their coverage overlaps. As soon as their protection begins to overlap, the risk for a conflict begins to increase. There is no “design” that allows them to coexist. Rather, they compete. It is a common misconception that “if having one real-time anti-malware product is good, then two must be better” when, in reality, it is just “piling on” overlapping applications.

“Layered protection” is having complimentary items/protection, as in this example:

Hardware router firewall
UEFI booted 64-bit Windows 8
Data Execution Prevention (DEP) set to ON for all programs and services
Windows Firewall
Real-time anti-malware protection (such as Windows Defender on Windows 8)
Spam/junk filter (usually provided by your ISP, email provider, or email client)

3. What is ELAM?

ELAM is Early Launch Anti-Malware protection and is a key feature/benefit of WD on W8. The reason that ELAM exists is to stop rootkits and other device driver types of malware, since the driver modules can all be validated and checked for malware before they are loaded, protecting the system from the moment the system begins to boot. This not only stops virtually all existing rootkits, but properly applied will also avoid the potential for future boot time malware, since it only loads what it absolutely must and then should make you aware of anything it can't identify that absolutely must be loaded to allow the system to boot.

To achieve this level of protection, you must be using hardware that provides UEFI (defined in the UEFI 2.3.1 specification), and you must be using 64-bit Windows 8.

UEFI is short for “Unified Extensible Firmware Interface”. A discussion of UEFI is beyond the scope of this document. A simplistic explanation is that it is the replacement for what we have known for the past 30+ years as the BIOS. UEFI provides many advances and features beyond BIOS. A key feature, and what makes ELAM possible, is the ability to authenticate module signatures at system boot time.

This is not “boot time scanning”, which was a manual boot time scan of the files on a PC similar to other old and archaic methods used by some third-party antivirus products of the past, and now a nearly useless feature, since boot time malware had rendered this method ineffective years ago.

The new Secure Boot ability in Windows 8 is made possible by the UEFI firmware standard. Windows 8 utilizes secure boot to ensure that the pre-OS environment is secure, assuming that UEFI firmware is available and enabled (in place of BIOS) on the PC itself.

There are huge differences in the two items mentioned above, so understanding these differences is important to determine if “boot time scanning” is useful or simply an anachronism from another time in the distant past.

For more information on how UEFI and ELAM work together, review Protecting the pre-OS environment with UEFI.

4. What if I rebuild/reinstall/recover my Windows PC from my manufacturer supplied media?

If you rebuild or reinstall using the supplied media or restore partition on your PC provided by the manufacturer, it is likely that a free or trial anti-malware product was part of that installation. You will need to uninstall the anti-malware product to return to Windows Defender, even if it was never activated. The list of anti-malware removal tools should be used to remove completely the third-party product.

5. Does WD provide a registry cleaner?

No. Moreover, you should not fall prey to all those websites that want to scan and clean your registry. There are many debates regarding “cleaning” the registry. The “registry”, to many users, is a magical, mysterious thing that contains thousands upon thousands of settings, coded cryptically in decimal, hexadecimal, and various other formats. Anything that affects your PC must be in registry, right? Well, no, but many who want access to your PC to sell you worthless software and tools, or to gain access to your PC for some purpose, will tell you that this is the case. You can find thousands of these registry tools on the internet. DO NOT USE THEM.

There are many users who have used a registry cleaning tool, only to find their PC inoperable later. For a discussion on this topic, read this. Additionally, there is no such thing as a registry booster. Moreover, any space reclaimed by cleaning the registry is miniscule and insignificant. Lastly, in the process of removing a virus or threat, if such a virus or threat has made changes to the registry, WD will correct those registry entries.

6. How well does WD protect you?

WD provides excellent protection. However, no anti-malware product (free or paid), or combination of products, will provide 100% protection, 100% of the time. Malware (viruses, worms, Trojans, spyware, rootkits, malicious scripts, etc.) is constantly changing, and anti-malware products always have to keep up.

Note that very few of the commonly referenced testing groups are certified by any recognized bodies. Most of these choose to call their results 'comparative' rather than a certification as a result. If a testing body has no certification itself, it is rather a stretch for them to purport that they have any right to call their own results a certification.

7. How do I know if WD is really working?

You can test WD using the EICAR test file. You can download the test file from here. You may want to review this page on intended use and contents of the test file.

8. Can I schedule when WD definition updates occur?

The ability to do this does not exist at this time. If you are concerned about an update occurring while using an application, or playing a game, do a manual update before starting such activity.

9. What if I leave my PC turned off for several days?

The virus definitions get out of date, and WD will update when you do turn on your PC. You can update manually by opening WD, selecting the Update tab, and clicking on UPDATE. If new definitions are available, they will be downloaded. You can also update WD by using Windows Update. If you encounter an error, WD may have already begun the update process. Wait a minute or so, and try again.

10. I do not understand WD’s definition updates.

The update process for WD is similar to MSE. For a detailed explanation of the WD update process, read this: MSE Definitions/Signatures Update FAQ. The exception is that WD updating respects the settings selected for Automatic Updates in Windows 8. If you have set AU to notify you, then WD will not automatically update and it will alert in about 7 days. WD will normally update itself about every 24 hours. You can update WD manually, if you want. Otherwise, it is not needed and causes unnecessary overhead. If an event occurs that requires immediate attention, the WD update system will force an update to occur. In addition, WD employs a “Dynamic Signature Service” (DSS). Whenever WD encounters something it does not know or recognize, it will send information to “Microsoft Active Protection Service” (MAPS). Depending on what MAPS determines from inspecting the information, it will cause an automatic download of definition updates to handle the malware.

11. How do I get definition updates and program upgrades?

WD definition updates are provided by Windows Update, and the “Update” tab in WD. Also, WD will update itself every 24-hours. If you need to update WD definitions while offline or using a slow connection, go to Microsoft Malware Protection Center and select the W8 definition files, and follow the instructions for installation.

For upgrades or updates to the WD application, these are delivered by Windows Update.

12. What is the difference between a Quick scan and a Full scan?

Real-time protection is the real protection against malware. Next, a quick scan will find orphaned files and auto-starts and stop them from running. Finally, a full scan can find malware missed by the quick scan. A full scan will “deep” scan every file on your system, including archive files (i.e. zip, rar, cab, etc.). A full scan can take hours to run. The decision to run a full scan is a personal preference. You might choose to run a full scan once per month, or before a complete backup. The decision is yours.

To scan a specific hard drive or USB device, select Custom scan and Scan Now, then choose the drive you wish to scan. A full scan will then be performed on the selected drive.

13. Will WD scan and update while my PC is asleep?

No. The PC must be on (not off, standby, hibernating, or asleep) for the scheduled scan to occur and for updates to download/install.

14. Can WD shutdown my PC once a scan is finished?

This cannot be accomplished from the WD user interface. However, you can accomplish this using the task scheduler or batch scripts. Review this thread for more information.

15. How do I schedule a scan with WD?

Windows Defender "scheduled scan" is included in Windows 8 Automatic Maintenance. Open the Action Center, click on "Maintenance", then on "Change maintenance settings", and then choose a time.

There is also a "Wake the computer" option. However, there is no reason to leave the computer on overnight. Leave the setting at the default of 3am, and turn off the computer normally. The scan will occur a short time after you turn on your PC.

For other options, look at Windows Defender in the Task Scheduler.

16. Where are WD Settings?

Open WD and click the Settings tab. There you will find various categories and their settings.

17. How do I temporarily disable Real-Time scanning?

You should not need to do this, even if a product manufacturer tells you it should be done prior to installing their software. However, if you feel you must temporarily disable real-time scanning, open WD, click the Settings tab, select Real-Time Protection, and clear the check box for “Turn on real-time protection”. Remember, you must turn real-time protection back on.

18. Where are the WD desktop and tray icons?

Windows Defender can be found on the Start screen, All Apps. If you really want a Desktop icon, do the following:

Use the charms, and search for Defender. Alternatively, go to the Start Screen, right-click, and select All Apps. Under the Windows System group, you will find Windows Defender.

Once you have found Windows Defender, right-click on it and select Open File Location. There you will find a shortcut to Windows Defender. Copy the shortcut, and paste it on your Desktop.

There is no tray icon with WD on W8. The Action Center icon reports WD issues.

19. How do I determine what version or build of WD I have?

Open WD and click on the “down pointer” to the right of “Help”. Then, click on “About Windows Defender”.

20. How do I get support for, and provide feedback on, WD?

Support for Windows Defender is provided by Microsoft for retail purchased copies of Windows 8 or by the computer manufacturer if Windows 8 was provided with the computer. For Microsoft provided Support options, start here: http://support.microsoft.com/get-support

Feedback on WD is unavailable at this time. It is suggested that you use MSE feedback in the interim, where your suggestions and feedback will likely be handled in the same manner as the feedback on MSE.

21. Can WD be used from the Command Prompt?

Yes. The MpCmdRun function of WD provides this ability.

To run this tool, go to the Start Screen, right-click, and select All Apps.

Under the Windows System group, right-click on Command Prompt, and select Run as Administrator. Click YES at the UAC prompt.

Then, from the Command Prompt window, enter the following commands:

> cd \Program Files\Windows Defender

> MpCmdRun /?

This will provide you with a list of commands and options that can be used from the Command Prompt with Windows Defender. You may want to review this thread for more information.

22. Where are the WD log files?

The MpCmdRun function of WD provides the ability to gather the following information/logs and packages them together in a compressed file in the support directory. This information includes:

Any trace files from Microsoft Antimalware Service
The Windows Update history log
All Microsoft Antimalware Service events from the System event log
All relevant Microsoft Antimalware Service registry locations
The log file of this tool
The log file of the signature update helper tool

To run this tool, go to the Start Screen, right-click and select All Apps.

Under the Windows System group, right-click on Command Prompt, and select Run as Administrator. Click YES at the UAC prompt.

Then, from the Command Prompt window, enter the following commands:

> cd \Program Files\Windows Defender

> MpCmdRun -getfiles -scan

At this point, logs will be collected and placed in a cab file. This process can take several minutes. When the process is complete, you will find the collected information here:

C:\ProgramData\Microsoft\Windows Defender\Support\MpSupportFiles.cab

Now, close the Command Prompt window. Then, using Windows Explorer, navigate to the above folder and extract the logs from the cab file to a location of your choice. Then, using Notepad, browse, examine, and peruse the logs and information.

Also, review the system event log for more information regarding WD events and the following event codes. These events are found in Event Viewer (Local), Applications and Services, Microsoft, Windows, Windows Defender, Operational:

1000 – Scan started
1001 – Scan completed
1002 – Scan stopped (canceled)
1005 – Scan terminated due to error
1011 – Item deleted from quarantine
1013 – History removed
1116 – Malware detection
1117 – Malware remediation
1118 – Malware remediation error (non-critical) [not confirmed]
1119 – Malware remediation error (critical)
2000 – Successful update
2001 – Failed update
2002 – Engine update
2010 – Dynamic Signature Service retrieved additional signatures
2011 – Dynamic Signature Service discarded obsolete signatures
3002 – Real-time protection failure: behavior monitoring
5000 – Real-time protection enabled
5001 – Real-time protection disabled
5004 – Real-time protection configuration changed
5007 – Configuration changed

23. Can I use a proxy?

If Windows 8 updates work, Windows Defender updates will work. However, KB2599808 may be of some interest to you.

You may also use this procedure:

Go to the Start Screen, right-click, and select All Apps.

Under the Windows System group, right-click on Command Prompt, and select Run as Administrator. Click YES at the UAC prompt.

Then, from the Command Prompt window, enter the command as per the examples below:

> NETSH WINHTTP SET PROXY 1.1.1.1:8080

> NETSH WINHTTP SET PROXY MYPROXY.NET:8080

24. I cannot use my VPN.

This is not a problem with WD. You must have your VPN provider update their software to recognize WD.

25. Does WD scan email?

No. There is no need for this to be done. What is important are attachments and links in email. When you attempt to open or save an attachment, or open a link, WD’s real-time protection inspects those items. Read this thread regarding the handling of email. However, the best rule you will ever find is “if you do not know the sender, do not open the attachments”. Better yet, do not open the mail.

26. Does WD filter junk email?

No, junk/spam email is not malware. Junk/Spam filters are a function of your email provider, and the email client that you use.

27. Does WD include a Firewall?

No. This is not necessary. W8 includes Windows Firewall in addition to Windows Defender. If you do install a third-party product, and later remove/uninstall it, make certain that the Windows Firewall is on. You can find the Windows Firewall in the Control Panel.

28. Are there other scanning options/solutions/tools from Microsoft?

The Malicious Software Removal Tool (MSRT) is provided via the monthly update from Microsoft, regardless of what anti-malware solution you have installed. It runs during the update process. MSRT can also be run on-demand if you download it.
Also available is the Microsoft Safety Scanner. This is not a real-time scanner. It is a free, downloadable, on-demand scanner.
Use Windows Defender Offline to create a bootable USB stick or CD to help remove threats from your system.
For corporate/commercial users, Microsoft Forefront is available.

29. What about cookies?

Cookies are not malware. Cookies are a browser issue, and are not a problem (except for privacy concerns). This is where third-party Cookies are used. Organizations and companies use third-party cookies to collect information about your viewing habits and preferences.

If these cookies concern you, you can turn them off. To turn them off in Internet Explorer, go to

Control Panel, All Control Panel items, Internet Options
Select the Privacy tab, Advanced
Check the box for Override automatic cookie handling and select the button to Block Third-Party Cookies.

For more information on Cookies, review http://winhelp2002.mvps.org/cookies.htm.

Also, note that other anti-malware products will report cookies in their scans, while WD does not. This gives the appearance that WD is not finding as many “viruses” as these other products, which is incorrect.

An additional note: If you are concerned about privacy and tracking, please visit the Do Not Track Test Page.

30. How do I remove/release a file or program that is being quarantined?

Open WD. Go to the History tab and select the Quarantined items radio button. Next, highlight the item you want restored and select Restore. Note that doing this will allow the file to exist and exposes you to risk of infection (if the file was infected).

31. Windows Backup and quarantined items

If you have items that are quarantined, and you use Windows 7 File Recovery (Windows Backup and Restore on Windows 7), you may see the backup fail (with error 0x81000031), complaining "Shadow Files Cannot be Read". You must either REMOVE or ALLOW any quarantined items, and re-run your backup. If you look up 0x81000031, you will likely be directed to KB973455, which will instruct you to delete reparse (junction) points, which is the incorrect answer to this problem. Simply remediate the quarantined files, and re-run the backup.

32. How do I backup my computer and data?

You should explore these W8 options for backing up your system/data:

Control Panel, All Control Panel Items, File History
Control Panel, All Control Panel Items, Windows 7 File Recovery
Using the charms, search for Windows Easy Transfer

You may also want to explore the use of a third-party backup solution, or storing your data on SkyDrive (or some other cloud solution).

33. How do I control Startup programs?

You can use press Ctrl+Shift+Esc to bring up Task Manager and use STARTUP tab to disable those programs you do not need.

34. Can I improve my startup performance?

Examine the necessity of the number of startup programs you have. To examine your startup programs, use the Task Manager. To do this, press Ctrl+Shift+Esc to bring up Task Manager and use STARTUP tab to disable those programs you do not need. Which startup programs should you keep, and which should you disable? Look at the startup program database on bleepingcomputer.com.

35. How do I use the MS Community forums?

The Microsoft Answer Forums support Windows, Internet Explorer, Office, Viruses and Malware, and Microsoft products. If your concern/issue is not addressed in these forums, just select the appropriate forum and ask your question. Provide your OS information, browser used, and any anti-malware products you have or had installed. You may want to review Suggestions for asking a question on help forums. Volunteers and users support the forums.

Note that the MS Community forums are for Microsoft Products. If you need help with a third-party product, contact the manufacturer of that product for support with their software.

36. Are calls from Microsoft to remove viruses legitimate?

No. It is not Microsoft that called you. Unless you specifically initiated a support case with Microsoft, this is a fraud/scam attempt. For more information, read Avoid scams that use the Microsoft name fraudulently and Avoid tech support phone scams.

37. What if I get a Pop-up for one of those fake anti-virus products?

If you clicked on it, or even if you simply closed the pop-up, you are likely infected and need to go into virus removal mode.

If you have not touched anything on the screen since the pop-up, you may be able to avoid being infected. The following assumes you are using Internet Explorer and WD. If not, adapt this procedure for the browser and anti-malware product you are using. Whenever you encounter one of these pop-ups while browsing, immediately do either of the following:

Shut down the PC without touching any browser windows.

Do not touch any browser window to close it or browse further. Immediately press Ctrl+Shift+Esc to bring up Task Manager. Select the Processes tab and END all instances of Internet Explorer by right clicking on the entry(s) and selecting END TASK. Then, shut down the PC.

Press Alt+F4 until all browser windows are closed. Then, shut down the PC.

Next, restart the PC. Once the PC restarts, go to

Control Panel, All Control Panel Items, Internet Options
Select the General tab, Browsing History, Delete
Select Temporary Internet files and Cookies, and Delete
Then, perform a full scan with WD.

If you are still having difficulty removing these fake products, use the Microsoft Answers Viruses and Malware forum for additional help, or get support from Microsoft as previously described in these faqs. You may also want to visit bleepingcomputer.com, where removal instructions are provided for many of these viruses.

38. Can I use a cleaner like CCleaner or Advanced System Care?

Yes, but make sure these cleaners are not deleting important WD files. You must find the appropriate settings in those tools and set them correctly if they concern you, or contact the manufacturer of those products for support. However, there is no need to use such tools, which can cause problems by deleting folders and files needed by W8, WD, and other applications.

If you really want to clean/remove temporary files, use Disk Cleanup that is included in W8. To find Disk Cleanup, use the charms and search for CLEANMGR.

39. Do I need JAVA?

Most likely not. There is Java and Javascript. Javascript is built into Internet Explorer. Very few applications need to install the Java application. If you are not sure, do not install JAVA. If you encounter an application that requires JAVA, it will inform you. You can then choose to install JAVA at that time. If you find that you have JAVA installed and do not need it, remove it. By not installing JAVA, you can avoid problems and issues associated with JAVA, its updates, and associated security issues/concerns. For more information on the risks of Java, read this document.

40. What about Adobe Flash Player?

Adobe Flash Player is now included in Internet Explorer, in both Modern and Desktop mode. Windows Update provides updates for Adobe Flash Player.

SECTION 4: A well-protected system

A well-protected system consists of several of areas of concern. Attention to each area will help keep your system protected. There is a Microsoft Fixit, which can address some of these concerns for you. To achieve a well-protected system, please consider these items/issues:

Hardware that supports UEFI-based Secure Boot
Windows 8, fully updated (including service packs), with Automatic Update ON
Data Execution Prevention (DEP) for all programs and services. For information on DEP, refer to KB912923 and to PAE/NX/SSE2 Support Requirement Guide for Windows 8.
All third-party applications (i.e. Java, Adobe Reader, etc.) updated. You must keep these applications up-to-date, as they are frequently updated to address security issues.
Windows Defender providing comprehensive real-time anti-malware protection
Internet Explorer with:
- Security tab: Default security settings (Reset all zones to default level)
- Privacy tab: Pop-up Blocker ON
- Advanced tab: Settings, Security, Enable SmartScreen Filter ON
Windows Firewall ON
Remote Registry Service NOT started
User Account Control (UAC) ON, and not running with elevated privileges
A good password policy in effect
A good backup procedure in effect
Only download software and drivers from the manufacturer/provider. There is no need to go anywhere else. Doing so will only put you at risk.
Visit Microsoft’s Malware Protection Center for the latest news on viruses and threats
And, YOU must practice safe surfing!

Acknowledgements

For their contributions to this checklist, thanks to:

Forum Post: Re: Analog TV that I connect to my laptop displays completely blue screen once Windows loads

Confused5066 — Tue, 23 Apr 2013 11:41:00 GMT

Thanks very much for responding to this question.

The fact that the computer's image does appear on the TV up until the point at which Windows loads seems to indicate to me that it is Windows Vista that is doing something to change the way in which the otherwise good signal is being sent to the converter. Apart from the 'Display Settings' window, I can't find anything that allows me, let alone informs me, as to what the signal is that Vista is sending...

That said...

In terms of the input resolution for the converter, using the options in the 'Display Settings' window, the lowest resolution I can pick for the second monitor (the TV) is 800x600. Doing this, however, doesn't resolve the problem. I note that the manual for the converter says the 'HDMI video input format' is 480p/576p/720p/1080i/1080p - this isn't in the format of a YxY, so I'm not sure what to make of it. Nor can I find anything on my computer or its user manual to tell me what its HDMI output is, so I can't check whether it matches the converter's input format.

In terms of the output resolution for the converter, the manual says there are two options (composite video output format): NTSC/480i and PAL/576i. Neither of these resolve the problem. I can't find the user manual for the TV, so I don't know what its input resolution is.

Forum Post: Program Not responding

Crankygeek01 — Tue, 23 Apr 2013 05:04:00 GMT

Hello,

I am new here and have read quite a few of the posts trying to find an answer to why my ARnC is suddenly not working anymore. (Well it worked excellent for DVD's but Blu Ray was causing my PC to blue screen after the compression started, which left me with a full copy of the movie, uncompressed. If I ran that file through handbrake to compress it, it was fine. It was only when I let it run through ARnC that I would blue screen.)

Anyway.....

As soon as I open MCE and click on ARnC, I immediately get a message stating the "The AutoRipNCompress program has stopped responding and you will be returned to Windows Media Center.

I have tried some of the solutions found in the thread but have had no luck at all. I have re-installed the software, deleted temp files and a few other things I found here. The only thing that has changed since it was working, is that I purched makeMKV and a program called Serviio (a media serving application for DNLA)

Any help would be greatly appreciated.

If you need log files posted, just let me know what ones and where they are located and I would be very happy to post them.

Thanks!

CrankyGeek01

Forum Post: Re: New channels (most likely h.264) problem

darekd — Mon, 22 Apr 2013 21:55:00 GMT

When I had windows 8 installed, I only installed Media Center and Nvidia latest driver for GT430 - no other codecs.

Forum Post: Re: Recommendations for a WMC Remote Control for Linksys Media Center Extender DMA2200

erkotz — Mon, 22 Apr 2013 21:21:00 GMT

Any official Windows Media Center remote (with a "green button") will work. Also most universal remotes will also work (I use a Logitech Harmony 880)

Forum Post: Re: Retrieving Metadata....

marvin-miller — Mon, 22 Apr 2013 21:19:00 GMT

Yeah, it's a tough one. I'm very surprised that, after all these years, it seems no-one has created a solution to this. If a person is recording/archiving a series and the series only has generic metadata, then you're pretty much stuck.

I did find a utility called MetaGenerator, it allows you to look up Movies and Series on theTVdB and then choose the season/episode. It then allows you to save an .xml file that TiVo will understand containing the metadata. So it's very close - if only applied the metadata to the .wtv file it would just be a matter of pointing/clicking/looking up episodes.

Forum Post: Re: WMC crashes with BSOD 100% of time when viewing VHF channels on HP Digital Entertainment Center

Jimnar — Sat, 20 Apr 2013 17:51:00 GMT

I believe I have solved my problem by completely reinstalling Windows 7 Ultimate. I then hid the Nvidia display adapter driver update that Windows Update said I should install. The system has not crashed since then.

Forum Post: Does System Image folder have to be in same location it was created for Windows 7 to detect it when doing system restore?

Keylonta — Sat, 20 Apr 2013 10:44:00 GMT

When restoring system files and settings from a system image, does the WindowsImageBackup folder have to be in the location it was created?

--For Example--

I create a system image on an external HDD, then later I want to do a system restore from that image, does the WindowsImageBackup folder have to be in the same location it was created (in this example, the root of the external HDD) for Windows 7 to detect it?

Forum Post: Re: Windows 7 RTM concurrent remote desktop patch

stickplayer — Fri, 19 Apr 2013 01:42:00 GMT

As I said in the post, I already fixed it with a restore. It's still a bug that the removal doesn't work.

Forum Post: Re: Multiple Hauppauge Colossus Cards in one PC

Octavean — Thu, 18 Apr 2013 16:31:00 GMT

Sorry I'm only using one Hauppauge Colossus card.

I also have two Hauppauge HD PVR units and I'm trying to get them working in one system. In my case I'm using DVBLink for Hauppauge HD PVR software and while I havent quite got it going (only one works) I feel the DVBLink software is more functional and reliable then the Hauppauge Media Center software.