Jump to content
John A

Fingerprinting FP

Recommended Posts

Windows XP, updating Flash player from Adobe site.  IE and Firefox open

 

"VB Scripting engine has been blocked from loading in the browser"

 

No AV

 

Don't know where the logs are kept on XP

Share this post


Link to post
Share on other sites

Which beta version are you running? This problem should be fixed in 1.08.1.1031

 

Check the "readme first" link in my signature for the MBAE logs location under XP.

Share this post


Link to post
Share on other sites

I am using 1.08.1.1031

 

Also getting Security certificate error on Malwarebytes forums (in IE only) (image attached)

 

Also just received MBAE fingerprint exploit error when trying to paste into IE (image attached)

 

Logs attached

post-14642-0-48756800-1444851292_thumb.j

post-14642-0-80422000-1444851302_thumb.j

mbae-service.zip

Share this post


Link to post
Share on other sites

Re: the vbscript, I thought you said Firefox. Are you getting this alert also on Firefox or not?

 

As for the fingerprinting exploit, where you trying to paste text, image, etc.? Paste into a text box? In the malwarebytes forum?

Share this post


Link to post
Share on other sites

John,

 

I've also encountered several security certificate errors using IE8 in XP... but not in other browsers there.   So I think it's best to avoid IE in XP at this point.

Share this post


Link to post
Share on other sites

Re: the vbscript, I thought you said Firefox. Are you getting this alert also on Firefox or not?

 

As for the fingerprinting exploit, where you trying to paste text, image, etc.? Paste into a text box? In the malwarebytes forum?

VB script error was Internet Explorer, although Firefox was open

Fingerprint - pasting text into a reply in Malwarebytes forum using Shift>Insert

Share this post


Link to post
Share on other sites

John,

 

I've also encountered several security certificate errors using IE8 in XP... but not in other browsers there.   So I think it's best to avoid IE in XP at this point.

Thanks. ky331.  I usually use Firefox, I was just updating Flash player in IE

Share this post


Link to post
Share on other sites

VB script error was Internet Explorer, although Firefox was open

OK. That's normal then. This is just MBAE preventing IE from loading the deprecated vbscript.dll module.

 

 

Fingerprint - pasting text into a reply in Malwarebytes forum using Shift>Insert

Wasn't able to repro. Can you repro with any text?

Share this post


Link to post
Share on other sites

 

 

Wasn't able to repro. Can you repro with any text?

 

Ahhh.  It actually happens when I try to attach an image, ie when I click Browse.  I originally thought it was the paste because I had just done that prior to adding an image.  Yes it is repro.

Share this post


Link to post
Share on other sites

What is the image name and the path to the directory?

 

Also when you click the "Attach" button what directory does your browser show by default?

Share this post


Link to post
Share on other sites

c:\documents and settings\john\desktop\Clipboard02.jpg

 

The error occurs before the browser displays the directory, but I turned off MBAE and tried it - it shows Desktop.

Share this post


Link to post
Share on other sites

Interesting. I did the following:

Turn off MBAE

Attach an image in a forum response from a different directory (downloads), so resetting the Attach browse directory.

Close IE

Start MBAE

Open IE and repeat the Attach image operation, it works with no alert from MBAE

Share this post


Link to post
Share on other sites

Hmmm interesting. Will attempt to repro this one although I suspect it will be difficult to repro as there are many variables such as the files on disk, directories, etc.

If you manage to figure out a way to repro this consistently let me know so we can send you a debug build to collect some extra logs.

Share this post


Link to post
Share on other sites

Sorry, I should have added ... but it still fails if I navigate to the Desktop.

 

I can reproduce it easily.  All I have to do is Attach a file to a reply and when the browse windows opens navigate to Desktop and the MBAE block occurs. (But it doesn't fail for other locations I tried, only fails on Desktop)

Share this post


Link to post
Share on other sites

Can you post or PM me the outputs of both "dir" and "dir /A:H" commands on your Desktop?

Share this post


Link to post
Share on other sites

Microsoft Windows XP [Version 5.1.2600]
© Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\John>cd desktop

C:\Documents and Settings\John\Desktop>
C:\Documents and Settings\John\Desktop>dir
 Volume in drive C is ACER
 Volume Serial Number is E0C2-1504

 Directory of C:\Documents and Settings\John\Desktop

17/10/2015  06:48    <DIR>          .
17/10/2015  06:48    <DIR>          ..
15/10/2015  11:56            13,541 Clipboard01.jpg
15/10/2015  06:29            28,527 Clipboard02.jpg
01/09/2013  15:07               689 IrfanView.lnk
18/09/2013  08:02             2,549 Microsoft Office Excel 2007.lnk
16/06/2014  08:23             2,515 Microsoft Office Word 2007.lnk
16/10/2013  10:52               652 NoteTab Light.lnk
17/08/2014  16:28         4,691,456 TeamViewerQS_en.exe
14/11/2012  17:58               786 Windows Media Player.lnk
27/09/2015  13:49    <DIR>          XP Keep Updating
               8 File(s)      4,740,715 bytes
               3 Dir(s)  93,916,995,584 bytes free

C:\Documents and Settings\John\Desktop>dir /A:H
 Volume in drive C is ACER
 Volume Serial Number is E0C2-1504

 Directory of C:\Documents and Settings\John\Desktop

File Not Found

C:\Documents and Settings\John\Desktop>

Share this post


Link to post
Share on other sites

I am now getting this same error on Windows 7 x 64 with 1.08.1.1039 when attempting to upload a photo to a forum or Facebook when browsing to Desktop.

Share this post


Link to post
Share on other sites

1.08.1.1040 still has the FP problem with IE in Windows 7 and XP

Share this post


Link to post
Share on other sites

This is happening to me in version  1.08.1.1045. It blocking a common Medical EMR called Centricity sold by GE, runs through Internet Explorer. 

Share this post


Link to post
Share on other sites

Welcome to the forum bdepew. Can you please post your MBAE logs? Instructions can be found in the "readme first" link in my signature.

 

Also can you please check to see if you have a shortcut to MBAE on your Desktop?

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.