DuaneTiemann Posted February 27, 2019 ID:1301061 Share Posted February 27, 2019 I use the SSLKEYLOGFILE env variable to allow browsers to log their SSL keys so I can decrypt traffic with Wireshark. This stopped working last week on IE, Chrome, and Firefox. I downloaded Firefox source, built it, etc. and noticed that it was getting values like "\\.\aswMonFltProxy\FFFFFA8036CE2C70" for SSLKEYLOGFILE. I hard coded the file name I wanted and it started working again. But I'm wondering who put that value in the SSLKEYLOGFILE env variable. Displaying it from a dos prompt gives the value I set. Malwarebytes is current and not finding an issue like this. I'm running Windows 7 with automatic updates. Thanks, Duane Link to post Share on other sites More sharing options...
exile360 Posted March 2, 2019 ID:1301534 Share Posted March 2, 2019 Greetings, asw sounds like something that likely belongs to Avast AV. If you have one of their products installed it is likely they have one or more components/drivers installed in the network stack, one of which is likely causing this modification. If you no longer have Avast installed, you may run their uninstall utility to remove any remnants by following the instructions in that link. Otherwise you might need to inquire on the Avast forums or contact Avast support for assistance with this issue to pursue a workaround if you do use Avast and do not wish to remove it from your system and hopefully they'll be able to provide a solution. Link to post Share on other sites More sharing options...
DuaneTiemann Posted March 2, 2019 Author ID:1301543 Share Posted March 2, 2019 Yup. You nailed it. Uninstalled Avast. I'm good. Not sure how it got installed in the first place and I thought it was disabled, but... Thanks, Duane Link to post Share on other sites More sharing options...
exile360 Posted March 2, 2019 ID:1301552 Share Posted March 2, 2019 You're welcome, I'm glad to be of service No idea how it got installed, so I can't help you there, but I will say that it is often the case that even when disabled, many AVs will still leave their drivers, filters and many other background components installed even when their primary protection components are disabled which is likely why that filter proxy (I'm assuming that's what it was based on the name; likely something similar to the Web Protection component in Malwarebytes) was still active in your connection and causing those results. Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now