I have a popular free screenshotter/uploader application and recently a user contacted me since the image captures came blank. After a lot of digging I found that Webroot's realtime protection is somehow intercepting the call to this Windows API function and the received image is blank. No errors whatsoever, the function completes and returns as normal, but the data is empty. After further digging I found that this happens only on a 32-bit process, but works normally on a 64-bit one. Running on Windows 10 x64. No warnings or any messages whatsoever from Webroot. Disabling realtime protection makes the 32-bit work fine.
What's going on?
https://msdn.microsoft.com/en-us/library/dd183370(v=vs.85).aspx
BitBlt intercepted on 32-bit process, blank image
Hi Shira
Welcome to the Community Forums.
WSA can be a tad 'over protective', generally because it has come across a process/file that it does not know about.
There are essentially 3 key areas where this can happen/a user can override WSA. These are essentially reached, from the main WSA panel, as follows:
In the case of 1. Block/Allow Files
If an item is set to:
- "Allow", WSA ignores it during scans and shield actions, meaning if it's a virus that has been allowed, it can continue acting as a virus acts. Be careful of what you allow in this area and ensure it's something you trust implicitly if you are going to change the status from Block to Allow.
- "Monitor", WSA will watch the item to determine if it is legitimate or related to malware. It is not necessary to add files into this list or set files to monitor manually unless you are changing them from a Block or Allow status. This might be useful if for example you think Webroot might have had a false positive on something and you want to check again at a later time to see if the determination has changed. You could set it to Monitor and have Webroot check it again.
- "Block", then WSA will treat the items as it would detected malware. It will not be executed, and it will not be written to your hard drive. Detected infections are automatically set to a Block status.
In the case of 2. Protected Applications (Internet Security & Complete version ONLY)
In this case:
- "Allowed applications" are not secured against information-stealing malware, and also have full access to protected data on the system. Many applications unintentionally access protected screen contents or keyboard data without malicious intent when running in the background. If you trust an application that is currently marked as "Deny," you can change it to "Allow."
- "Protected applications" are secured against information-stealing malware, but also have full access to data on the system. By default, web browsers are assigned to the "protected" status. If desired, you might also want to add other software applications to "protected," such as financial management software. When you run a protected application, the Webroot icon in the system tray displays a padlock.
- "Denied applications" cannot view or capture protected data on the system, but can otherwise run normally.
And finally, in the case of 3. Control Active Processes
If a process is set to:
- "Allow" it means WSA allows it to run on the system. It's important to note that if an item is already allowed here, that's because Webroot knows already from seeing the file before that it's ok to allow.
- "Monitor" status means WSA will journal what that program is doing and keep a very close eye on it for any suspicious activity. Basically it would treat it as if it wasn't already sure about it one way or the other, and it wants to monitor it closely until it's sure about it.
- "Block" means just that...WSA does not allow it to run on the system. Be very careful about what you block in this area and ensure that anything you decide to block is a non-essential process. Otherwise, you could be setting yourself up for a lot of grief if you block something critical.
Now, hopefully that has given you a consolidated low down on where to look and what you can do to affect how WSA 'interferes' with files, objects & processes on your system...and so will help you get to the bottom of what is causing you grief… (I am indebted to the KB article by JimM of which this is my re-interpretation).
Do post back with any specific questions that you may have re. the above.
Hope that helps?
Regards, Baldrick
Welcome to the Community Forums.
WSA can be a tad 'over protective', generally because it has come across a process/file that it does not know about.
There are essentially 3 key areas where this can happen/a user can override WSA. These are essentially reached, from the main WSA panel, as follows:
- PC Security > Block/Allow Files
- Identity Protection > Application Protection
- Utilities > System Control > Control Active Processes
- "Allow"
- "Protect/Monitor"
- "Block/Deny"
In the case of 1. Block/Allow Files
If an item is set to:
- "Allow", WSA ignores it during scans and shield actions, meaning if it's a virus that has been allowed, it can continue acting as a virus acts. Be careful of what you allow in this area and ensure it's something you trust implicitly if you are going to change the status from Block to Allow.
- "Monitor", WSA will watch the item to determine if it is legitimate or related to malware. It is not necessary to add files into this list or set files to monitor manually unless you are changing them from a Block or Allow status. This might be useful if for example you think Webroot might have had a false positive on something and you want to check again at a later time to see if the determination has changed. You could set it to Monitor and have Webroot check it again.
- "Block", then WSA will treat the items as it would detected malware. It will not be executed, and it will not be written to your hard drive. Detected infections are automatically set to a Block status.
In the case of 2. Protected Applications (Internet Security & Complete version ONLY)
In this case:
- "Allowed applications" are not secured against information-stealing malware, and also have full access to protected data on the system. Many applications unintentionally access protected screen contents or keyboard data without malicious intent when running in the background. If you trust an application that is currently marked as "Deny," you can change it to "Allow."
- "Protected applications" are secured against information-stealing malware, but also have full access to data on the system. By default, web browsers are assigned to the "protected" status. If desired, you might also want to add other software applications to "protected," such as financial management software. When you run a protected application, the Webroot icon in the system tray displays a padlock.
- "Denied applications" cannot view or capture protected data on the system, but can otherwise run normally.
And finally, in the case of 3. Control Active Processes
If a process is set to:
- "Allow" it means WSA allows it to run on the system. It's important to note that if an item is already allowed here, that's because Webroot knows already from seeing the file before that it's ok to allow.
- "Monitor" status means WSA will journal what that program is doing and keep a very close eye on it for any suspicious activity. Basically it would treat it as if it wasn't already sure about it one way or the other, and it wants to monitor it closely until it's sure about it.
- "Block" means just that...WSA does not allow it to run on the system. Be very careful about what you block in this area and ensure that anything you decide to block is a non-essential process. Otherwise, you could be setting yourself up for a lot of grief if you block something critical.
Now, hopefully that has given you a consolidated low down on where to look and what you can do to affect how WSA 'interferes' with files, objects & processes on your system...and so will help you get to the bottom of what is causing you grief… (I am indebted to the KB article by JimM of which this is my re-interpretation).
Do post back with any specific questions that you may have re. the above.
Hope that helps?
Regards, Baldrick
So basically any custom or unknown application can't call BitBlt? (that's really extreme) but why does it work compiled as 64-bit?
Well, I think that you need to find any of the components that relate to BitBlt that may be registered under the Identity Protection Shield and, if you believe that they are safe, unblock them...if they are blocked.
Regards, Baldrick
Regards, Baldrick
It's a simple call to a function from Gdi32.dll, I don't think there's a specific setting for this other than the full real-time protection. But you must realize the huge scope of this, intercepting and returning empty data without any error to such a widely used function by many apps, I think this is extreme, and the worst part is WR won't even warn the user. That plus the fact it only happens on a 32-bit process makes me think this isn't an intended behaviour but rather a bug.
https://en.wikipedia.org/wiki/Bit_blit
https://en.wikipedia.org/wiki/Bit_blit
Well, I won't debate that side of things with you...but rather I suggest that you Open a Support Ticket to inform the Support Team so that they can investigate and hopefully help you resolve the issue.
Regards, Baldrick
Regards, Baldrick
Login to the community
No account yet? Create an account
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.