NAV Script Blocking Is Not Working

[Nix]

I have NAV 2001 and all the upgrades etc via live update.

I have just noticed recently that the script blocking part of it does not seem to work anymore.

When I used to execute a .vbs file it would come with a screen with 5 options.

Now it just runs it.

I went to the Symantec knowldege base and found an article about how to test if script blocking is working - ie download a test script and run it.

It didn't say what to do if it is not.

Any help would be appreciated.

Using Win Me

 

[TonyKlein]

Hi Nix,

Welcome to the board!

I take it you mean this one: How to determine whether Script Blocking is protecting your computer?

It does explain how it works: If Script Blocking is working NAV will issue an alert.

If you don't get the alert, you have a possible problem.

Good luck,

 

[Nix]

You are correct, I don't get any alerts.

 

[TonyKlein]

And you do get the script blocking sample??

For I don't even get that, but that is because I've uninstallled the WSH, renamed Mshta.exe, Cscript.exe, etcetera.

So I can't test it for you.

Grtz.

 

[Nix]

I'm gonna follow two articles from the site to firstly manually disable script blocking from within the registry and then manually unistall NAV by deleting registry entries and deleting installed folders and files.

All this from safe mode and after backing up the registry prior to commencing the 'clean up'.

Then clean reinstall of NAV and then download all updates, but individually ie all for NAV, then all for Live Update, then all for Rescue and then all for Virus definitions.

It's gonna be slow but hopefully that will fix things up.

 

[Davey7549]

Nix and Tony
This problem seems to be more widespread then realized.
After reading the thread I tested and found no alerts. After digging through Symatecs site I found many entries on the same problem. Below is a link to one that I found quite interesting because it was not the canned uninstall and reinstall answer.
The last two posts towards bottom suggest other things to try with the final being uninstall/reinstall.
I suspect Symantec has a problem and has since patched it or are still trying to figure out what is causing it.

Click Here for Article
By the way I tried all their fixes and still no go!
If you guys dig up more info please pass it on.
Dave

 

[Nix]

Hmmm, what I shall do is do the manual clean up and then reinstall.

Then start the downloads via Live Update until the script blocking one is installed.

Then test to see if it works.

Assuming it does, i shall then continue with live updates and test after each one and see if one disables it.

 

[Nix]

Ok, I think I've discovered the problem.

I sent this through the Symantec support site, will be interesting what they come back with.

Money hopefully for me doing their work for them - yeah and monkeys might fly out of my butt.

I happened to notice just recently that script blocking was no longer working.

I posted to a couple of techncial forums but also decided to look here at Symantec.

After reading through the many posts, I followed the articles titled:-

How to disable Script Blocking manually &
How to uninstall Norton AntiVirus 2001 manually when installed under Windows 95/98/Me.

Firstly, on my system, the following keys identified under point 8 of the first article had a second key ScriptBlockingInProcServer32 with a different value to default, deleting the default caused vbscripts to produce an error box.

HKEY_CLASSES_ROOT\CLSID\{06290BD5-48AA-11D2-8432-006008C3FBFC}

HKEY_CLASSES_ROOT\CLSID\{06A7EC63-4E21-11D0-A112-00A0C90543AA}

HKEY_CLASSES_ROOT\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}

HKEY_CLASSES_ROOT\CLSID\{F935DC22-1CF0-11D0-ADB9-00C04FD58A0B}

After copying the second key value to the default vbscripts worked again.

After following the articles, I reinstalled NAV 2001 and began the process of LiveUpdate to download all the updates.

Basically I left the Virus defs till last.

Slowly but surely over my 56K dial up I installed updates, to NAV, Live Update, Rescue Disk and Script Blocking got installed and worked !

I kept on with Live Update always leaving the virus defs until the only thing left was the virus defs.

At this point Script Blocking was still working.

I downloaded the virus defs and POW Script Blocking no longer worked.

Today I followed the two articles again to remove NAV from my system.

I searched the hard drive for any other *Nort* or *Symant* files and found a cople of other folders that I also deleted.

I reinstalled NAV and this time before doing the final download of virus defs, I exported the registry and made copies of all the Norton and Symantec related folders.

I downloaded the virus defs and exported the registry to another named reg file.

I tediously went through the two reg files comparing keys and values and then began doing the same for all the folders and files that I had made copies of.

I came across a file in C:\Program Files\Common Files\Symantec Shared\VirusDefs\20011206.019 called SCRAUTH.DAT and decided on a whim to rename it to SCRAUTH.DAT.BAK.

I tried a vbscript and presto was presented with the Alert screen.

So, basically what is SCRAUTH.DAT as it is obviously the cause of the problem and now that I have pin pointed it down to this file maybe you can stop telling people you are unable to recreate it and fix it for good.

 

[TonyKlein]

Hey Nix,

Well done!
Do keep us posted about what Symantec comes back with.

Greetz,

 

[Davey7549]

Nix
Great Detective work! I now have 4 machines in the same position
where script blocking is not functioning. All are current with NAV updates. Keep us informed! Thanks again for the info.
Dave

 

[Nix]

Strangely I cannot find my post at the Symantec web site.

I've reposted, hopefully something will happen soon.

 

[Davey7549]

Nix
Yes I hope they do to. I went and tried your trick renaming the
SCRAUTH.DAT (script authorization) file on all four of our computers and the script blocking test works. I suspect someone
listed the test script in the dat file as authorized. Question then becomes will the blocker work on all not listed in there.
Dave

 

[Nix]

Actually I think that the SRCAUTH.DAT file is corrupt or something.

I have used some other demo .VBS and .JS scripts that I stumbled across on my system (can't remember where).

Plus based on one of them I wrote a script of my own to reset a flag in the registry on startup.

All of them don't get detected unless the SCRAUTH.DAT is renamed.

P.S. Moderators - my solution is only a workaround, I'm still waiting on a response from Symantec in regards to resolution of the problem, so I wouldn't regard it as being solved.

 

[Davey7549]

Nix
I your test data is correct then anyone with updates >= 11/28/01
are not protected from script invasion.
Dave

 

[Nix]

Ok, the tech at Symantec reckons that if it is not a malicious script then it will not be detected by design.

I say this is a load of cra* and have posted a couple more replies to my post.

Go Here for the ongoing saga.