Not 100% sure its a false positive, but....

[drdas]

Tried emailing support, but haven't heard back for five days, so thought I'd pick some brains here.

No new installed programs or funny-acting activity on my fully updated Windows 10 computer, but I just started getting what I think to be a false positive exploit block every time I open Internet Explorer 11, regardless of my homepage (currently google.com, but I've tried many others). It's possible this has been a problem for longer, but I so rarely use IE that I didn't see it. I don't use any installed toolbars. I have no problems (or alerts) using Edge or Firefox (my go-to choice). Posted log from Malwarebytes 3.0 for your input.

The associated file (C:\WINDOWS\system32\VBScript.dll) scans clean using both McAfee and Microsoft's own security scanner.

Thanks in advance for anyone's thoughts.

 

Malwarebytes
www.malwarebytes.com

-Log Details-
Protection Event Date: 4/13/17
Protection Event Time: 5:41 PM
Logfile: malwarebytes.txt
Administrator: Yes

-Software Information-
Version: 3.0.6.1469
Components Version: 1.0.103
Update Package Version: 1.0.1724
License: Premium

-System Information-
OS: Windows 10
CPU: x64
File System: NTFS
User: System

-Exploit Details-
File: 0
(No malicious items detected)

Exploit: 1
Malware.Exploit.Agent.Generic, , Blocked, [0], [-1],0.0.0

-Exploit Data-
Affected Application: Internet Explorer (and add-ons)
Protection Layer: Application Hardening
Protection Technique: Attempt to execute VBScript blocked
File Name: C:\WINDOWS\system32\VBScript.dll
URL:

 

(end)

[Rsullinger]

Hey drdas,

 

All vbscript.dll does is allows programs to call it to run vbscripts. So if this is only happening in IE when you launch it, something may be trying to run a VB script in IE. If you are not sure the contents of this, I would reset IE back to defaults just to be safe. Check IE for any suspicious looking add-ins and remove them as well. Also make sure the home page is set to the default loading and not any strange redirect sites. 

[drdas]

Thanks for the idea. No suspicious add-ons; the only one that is enabled is OneNote; I disabled it to see if it would affect the Malwarebytes pop-up, but no change.

Reset all IE settings, then rebooted. But the same Malwarebytes pop-up occurred when I reopened IE.

I have IE VB scripting disabled in my settings (see attached image), but wouldn't think it would fire off whenever I open IE, unless for some reason the MWB developers have it designed that way. I have other computers (not Windows 10) that run MWB and IE without this pop-up, so unless it is an issue with my specific configuration interacting with MWB, there must be something going on... I just can't seem to find it. Full MWB, McAfee and Microsoft security scans don't pick anything up either.

That's why I filed it in false positives, but continue to welcome any other thoughts.

 

Edited April 17, 2017 by drdas

[Rsullinger]

Hey drdas,

 

I am going to send you a PM with some instructions to collect some further logging. Go ahead and send the logs back in that PM just so I can reveiw them. 

[PhilC50]

I have this same exact problem when opening a library in SharePoint.

It drives my users crazy and generates a lot of calls to me.

Turning off Disable Internet Explorer VB Scripting seems to fix it but don't know if that is very secure.