1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

NAV Script Blocking Is Not Working

Discussion in 'Earlier Versions of Windows' started by Nix, Dec 4, 2001.

Thread Status:
Not open for further replies.
Advertisement
  1. Nix

    Nix Thread Starter

    Joined:
    Dec 2, 2001
    Messages:
    102
    I have NAV 2001 and all the upgrades etc via live update.

    I have just noticed recently that the script blocking part of it does not seem to work anymore.

    When I used to execute a .vbs file it would come with a screen with 5 options.

    Now it just runs it.

    I went to the Symantec knowldege base and found an article about how to test if script blocking is working - ie download a test script and run it.

    It didn't say what to do if it is not.

    Any help would be appreciated.

    Using Win Me
     
  2. TonyKlein

    TonyKlein Malware Specialist

    Joined:
    Aug 26, 2001
    Messages:
    10,392
  3. Nix

    Nix Thread Starter

    Joined:
    Dec 2, 2001
    Messages:
    102
    You are correct, I don't get any alerts. :(
     
  4. TonyKlein

    TonyKlein Malware Specialist

    Joined:
    Aug 26, 2001
    Messages:
    10,392
    And you do get the script blocking sample??

    For I don't even get that, but that is because I've uninstallled the WSH, renamed Mshta.exe, Cscript.exe, etcetera.

    So I can't test it for you.

    Grtz.
     
  5. Nix

    Nix Thread Starter

    Joined:
    Dec 2, 2001
    Messages:
    102
    I'm gonna follow two articles from the site to firstly manually disable script blocking from within the registry and then manually unistall NAV by deleting registry entries and deleting installed folders and files.

    All this from safe mode and after backing up the registry prior to commencing the 'clean up'.

    Then clean reinstall of NAV and then download all updates, but individually ie all for NAV, then all for Live Update, then all for Rescue and then all for Virus definitions.

    It's gonna be slow but hopefully that will fix things up.
     
  6. Davey7549

    Davey7549

    Joined:
    Feb 28, 2001
    Messages:
    11,584
    Nix and Tony
    This problem seems to be more widespread then realized.
    After reading the thread I tested and found no alerts. After digging through Symatecs site I found many entries on the same problem. Below is a link to one that I found quite interesting because it was not the canned uninstall and reinstall answer.
    The last two posts towards bottom suggest other things to try with the final being uninstall/reinstall.
    I suspect Symantec has a problem and has since patched it or are still trying to figure out what is causing it.

    Click Here for Article
    By the way I tried all their fixes and still no go!
    If you guys dig up more info please pass it on.
    Dave
     
  7. Nix

    Nix Thread Starter

    Joined:
    Dec 2, 2001
    Messages:
    102
    Hmmm, what I shall do is do the manual clean up and then reinstall.

    Then start the downloads via Live Update until the script blocking one is installed.

    Then test to see if it works.

    Assuming it does, i shall then continue with live updates and test after each one and see if one disables it.
     
  8. Nix

    Nix Thread Starter

    Joined:
    Dec 2, 2001
    Messages:
    102
    Ok, I think I've discovered the problem.

    I sent this through the Symantec support site, will be interesting what they come back with.

    Money hopefully for me doing their work for them - yeah and monkeys might fly out of my butt.

    I happened to notice just recently that script blocking was no longer working.

    I posted to a couple of techncial forums but also decided to look here at Symantec.

    After reading through the many posts, I followed the articles titled:-

    How to disable Script Blocking manually &
    How to uninstall Norton AntiVirus 2001 manually when installed under Windows 95/98/Me.

    Firstly, on my system, the following keys identified under point 8 of the first article had a second key ScriptBlockingInProcServer32 with a different value to default, deleting the default caused vbscripts to produce an error box.

    HKEY_CLASSES_ROOT\CLSID\{06290BD5-48AA-11D2-8432-006008C3FBFC}

    HKEY_CLASSES_ROOT\CLSID\{06A7EC63-4E21-11D0-A112-00A0C90543AA}

    HKEY_CLASSES_ROOT\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}

    HKEY_CLASSES_ROOT\CLSID\{F935DC22-1CF0-11D0-ADB9-00C04FD58A0B}

    After copying the second key value to the default vbscripts worked again.

    After following the articles, I reinstalled NAV 2001 and began the process of LiveUpdate to download all the updates.

    Basically I left the Virus defs till last.

    Slowly but surely over my 56K dial up I installed updates, to NAV, Live Update, Rescue Disk and Script Blocking got installed and worked !

    I kept on with Live Update always leaving the virus defs until the only thing left was the virus defs.

    At this point Script Blocking was still working.

    I downloaded the virus defs and POW Script Blocking no longer worked.

    Today I followed the two articles again to remove NAV from my system.

    I searched the hard drive for any other *Nort* or *Symant* files and found a cople of other folders that I also deleted.

    I reinstalled NAV and this time before doing the final download of virus defs, I exported the registry and made copies of all the Norton and Symantec related folders.

    I downloaded the virus defs and exported the registry to another named reg file.

    I tediously went through the two reg files comparing keys and values and then began doing the same for all the folders and files that I had made copies of.

    I came across a file in C:\Program Files\Common Files\Symantec Shared\VirusDefs\20011206.019 called SCRAUTH.DAT and decided on a whim to rename it to SCRAUTH.DAT.BAK.

    I tried a vbscript and presto was presented with the Alert screen.

    So, basically what is SCRAUTH.DAT as it is obviously the cause of the problem and now that I have pin pointed it down to this file maybe you can stop telling people you are unable to recreate it and fix it for good.
     
  9. TonyKlein

    TonyKlein Malware Specialist

    Joined:
    Aug 26, 2001
    Messages:
    10,392
    Hey Nix,

    Well done!
    Do keep us posted about what Symantec comes back with.

    Greetz,
     
  10. Davey7549

    Davey7549

    Joined:
    Feb 28, 2001
    Messages:
    11,584
    Nix
    Great Detective work! I now have 4 machines in the same position
    where script blocking is not functioning. All are current with NAV updates. Keep us informed! Thanks again for the info.
    Dave
     
  11. Nix

    Nix Thread Starter

    Joined:
    Dec 2, 2001
    Messages:
    102
    Strangely I cannot find my post at the Symantec web site.

    I've reposted, hopefully something will happen soon.
     
  12. Davey7549

    Davey7549

    Joined:
    Feb 28, 2001
    Messages:
    11,584
    Nix
    Yes I hope they do to. I went and tried your trick renaming the
    SCRAUTH.DAT (script authorization) file on all four of our computers and the script blocking test works. I suspect someone
    listed the test script in the dat file as authorized. Question then becomes will the blocker work on all not listed in there.
    Dave
     
  13. Nix

    Nix Thread Starter

    Joined:
    Dec 2, 2001
    Messages:
    102
    Actually I think that the SRCAUTH.DAT file is corrupt or something.

    I have used some other demo .VBS and .JS scripts that I stumbled across on my system (can't remember where).

    Plus based on one of them I wrote a script of my own to reset a flag in the registry on startup.

    All of them don't get detected unless the SCRAUTH.DAT is renamed.

    P.S. Moderators - my solution is only a workaround, I'm still waiting on a response from Symantec in regards to resolution of the problem, so I wouldn't regard it as being solved.
     
  14. Davey7549

    Davey7549

    Joined:
    Feb 28, 2001
    Messages:
    11,584
    Nix
    I your test data is correct then anyone with updates >= 11/28/01
    are not protected from script invasion.
    Dave
     
  15. Nix

    Nix Thread Starter

    Joined:
    Dec 2, 2001
    Messages:
    102
    Ok, the tech at Symantec reckons that if it is not a malicious script then it will not be detected by design.

    I say this is a load of cra* and have posted a couple more replies to my post.

    Go Here for the ongoing saga.
     
  16. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/60723

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice