David H. Lipman Posted September 12, 2020 Author ID:1407318 Share Posted September 12, 2020 Gracias - Done... Link to post Share on other sites More sharing options...
LiquidTension Posted September 16, 2020 ID:1407907 Share Posted September 16, 2020 (edited) Hi David, According to the most recent FRST logs, you still have a local system proxy configured which is likely the cause of your issue. Given you manually removed it previously, it's apparent there is something present on the machine that is regenerating it. You could start off by experimenting with a clean boot to see if a particular installed program is responsible. Beyond that, using something like Sysmon or boot time Process Monitor (assuming it's being regenerated at boot) may give you an indication of the source. I've attached a Sysmon config file that will monitor for and report changes to any value named "ProxyServer". Install Sysmon: sysmon -accepteula -i config.xml Events are logged to the Microsoft-Windows-Sysmon/Operational event log. Stop monitoring/uninstall Sysmon: sysmon -u config.zip Edited September 16, 2020 by LiquidTension Link to post Share on other sites More sharing options...
David H. Lipman Posted September 16, 2020 Author ID:1407927 Share Posted September 16, 2020 (edited) Domo arigato @LiquidTension No change. I keep the utility in question updated and in-hand and installed the "System Monitor service" per your request and monitored MBAM accessing the account. Nothing was logged. I then specifically loaded Fiddler and setup MBAM to use a Fiddler Proxy. Results ==> Data.ZIP Note that no other program complains about a Proxy. There is only a Proxy use when I specifically setup one like Fiddler. No other components of MBAM have issues and the program gets updates. It is only an issue with keystone.mwbsys.com and it only occurs when checking license compliance. It did not happen with 4.1.x nor when I updated to v4.2. It only occurred after a v4.2.x update. When I started this thread, I was at: 4.2.0.82, 1.029403 and 1.0.1036 and I am now at 4.2.0.82, 1.029939 and 1.0.1045 With the same inability to access the license server problem. If it was a Proxy issue I would have a problem getting updates too as all MBAM components would use a Proxy and not just the License Server check-in process. As you previously noted, this is the issue... On 9/4/2020 at 11:59 AM, LiquidTension said: Thank you. This is the issue: "Exception details: text=SSL Exception: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed" Referencing "Certificate verify failed", it begs the questions... Does MBAM use OpenSSL or the Microsoft CryptoAPI ? Does MBAM use or depend upon external DLL/modules or are they embedded/compiled ? Where is the Certificate? Is it a disk file (.cer/.der, .crt, .pem, .key, .p7b/.p7c, .pfx, etc) ? Is it in the certificate store ? Can we verify the certificate chain with an OCSP ? EDIT: As I wrote this v4.2.1 was released. However it will not perform and online in situ upgrade and actually downgrades the program. From; 4.2.0.82, 1.029939 and 1.0.1045 to 4.2.0.82, 1.029391 and 1.0.1036 I await the release of the Offline installer for v4.2.1 Edited September 16, 2020 by David H. Lipman Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted September 29, 2020 Root Admin ID:1410522 Share Posted September 29, 2020 We're working on a test version. Hopefully not too much longer and I'll be able to provide you a test build. Link to post Share on other sites More sharing options...
David H. Lipman Posted September 29, 2020 Author ID:1410591 Share Posted September 29, 2020 Xiexie ni @AdvancedSetup Link to post Share on other sites More sharing options...
Root Admin Solution AdvancedSetup Posted October 12, 2020 Root Admin Solution ID:1413731 Share Posted October 12, 2020 We have confirmed the issue and a fix is in beta. The release should also be out before too long. As such I will go ahead and close this topic now. I have been in contact with the customer about this issue. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted October 12, 2020 Root Admin ID:1413732 Share Posted October 12, 2020 Glad we could help. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Please review the following for Tips to help protect from infection Thank you Link to post Share on other sites More sharing options...
Recommended Posts