1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

ScriptBlocking Service

Discussion in 'Security and Privacy' started by Christer, 2003/09/26.

Thread Status:
Not open for further replies.
  1. 2003/09/26
    Christer

    Christer Geek Member Staff Thread Starter

    Joined:
    2002/12/17
    Messages:
    6,585
    Likes Received:
    74
    Hello all!

    Symantec installs ScriptBlocking Service (SBServ.exe). It is by default set to automatic.

    On my system, as soon as it gets started it is immediately stopped.
    When I start it in Administrative Tools / Services it is immediately stopped.

    Does anyone know what causes this to happen?

    Thanks for Your time,
    Christer
     
    Last edited: 2003/09/26
    Christer,
    #1
  2. 2003/09/27
    Johanna

    Johanna Inactive Alumni

    Joined:
    2003/03/08
    Messages:
    2,402
    Likes Received:
    2
    Christer,
    I have NIS 2003 and Norton Utilities 2002, and I found that service exactly as you described, set to "automatic." But it does not appear on the task manager's list of running processes, and it is not on the start up menu at all. So perhaps it just waits until it is needed, then comes to life? You said it is set to automatic. What is telling you that it is stopped? An error message? Any dialog box? Wonder how it knows which scripts to block, and if there is a way to configure that? Thanks, Christer, now I'll be up all night!

    Johanna

    off researching Script Blocking by Symantec...

    btw, I noticed the exe is listed as "Script blocking registration "- maybe it's part of the LU?
     
    Last edited: 2003/09/27
    Johanna,
    #2


  3. to hide this advert.

  4. 2003/09/28
    miniB

    miniB Inactive

    Joined:
    2003/03/21
    Messages:
    489
    Likes Received:
    0
    Hi

    Is this not just the 'plug-in' for Office applications which would come into action if working with a suspicious script ? Mine is set to automatic also but I have never seen an alert (really don't want to either!!) I just wonder if it detects script things that may be on a web page or e-mails???
    I have just checked again and see if it's on Auto then it will stop a malicious script without alerting you to this. If set to manual then it will alert and ask you what you want to do.

    I am not sure how I would know it's stopped as Christer has found out :confused:
     
    miniB,
    #3
  5. 2003/09/28
    Christer

    Christer Geek Member Staff Thread Starter

    Joined:
    2002/12/17
    Messages:
    6,585
    Likes Received:
    74
    Hi guys,
    on Windows XP go to Control Panel > Administrative Tools > Services.

    Services can be set to Automatic, Manual or Disabled. Automatic = started when Windows starts, Manual = started when a program that needs the Service is started, Disabled = not available.

    For each Service there´s a status indication, "blank" or "started ".

    ScriptBlocking Service is by default set to Automatic so the fact that it isn´t started indicates to me that something stops it.

    Double-click the Service and start it manually. It gets the indication as started but exit Services and go back and check. My bet is that it has been stopped and the status is again blank.

    ScriptBlocking is part of NAV and NPF. It detects possible virus that has not yet been defined and therefore not included in the virus definitions.

    I´m having an E-mail conversation with Symantec Support. They think that it´s a problem with my setup and have suggested to uninstall and reinstall.
    I don´t believe that´s the case since I´ve checked two other computers, one XP Home and one XP Professional and both behave exactly like mine.

    I have told this to SS and also suggested that it might be an incompatibility issue with a Windows Hotfix.

    The reason for believing this is that a month or so ago I changed the settings for a couple of Services and I would probably have noticed a Service set to automatic but not started ...... :confused: ......

    I´ll let You know what I find out!

    Christer
     
    Last edited: 2003/09/28
    Christer,
    #4
  6. 2003/09/28
    miniB

    miniB Inactive

    Joined:
    2003/03/21
    Messages:
    489
    Likes Received:
    0
    Hi

    I have just checked my services too - set to Automatic but the service has not been started - 'yes' you have guessed it - started - came out and back again - automatic - start service!
    Does this not indicate that it would start if it was needed?

    It seems to be the SS answer to a lot of problems - re-install everything! I used to get a lot better one to one support by e-mail but now by the time you get to the 'contact us' they either tell you to re-install on a clean boot of Windows or refer you to the KB when the actual article does not describe the full problem.

    I have now decided that I am not upgrading to the new 2004 version and within the next few weeks I am uninstalling the software completely. There are far too many conflicts arising with it now. This just adds to the issue - I have configured my services for security and effiency - I would not know which of these has conflicted with this service now :confused:
     
    miniB,
    #5
  7. 2003/09/28
    Christer

    Christer Geek Member Staff Thread Starter

    Joined:
    2002/12/17
    Messages:
    6,585
    Likes Received:
    74
    Hi miniB!

    No, it indicates to me that something stops it as soon as it has been started.

    Once, when starting my computer, I hit ctrl-alt-del to bring up the Task Manager > Processes as soon as possible. The SBServ.exe appears in TM during startup but gets shut down.
    I have no idea why or by what.

    I´ll wait for Symantecs response to my latest E-mail to see if they have investigated the Hotfixes. If they haven´t, I will.

    Christer
     
    Christer,
    #6
  8. 2003/09/29
    charlesvar

    charlesvar Inactive Alumni

    Joined:
    2002/02/18
    Messages:
    7,024
    Likes Received:
    0
    Hey Christer,

    Running NAV2002 on XP, same situation. Since I run SSM (System Saftety Monitor), don't worry about whether it works or not.

    However, I'm going to make a few guesses based on experience running stand-alone script blockers on XP and on 9X.

    For example, currently running a fairly old program called Script Trap on 9X. Does not show up as running in the background, but know it works, have had it pop up with a warning at the appropriate times. It warns whenever Word wants to run, for instance. Prior to installing SSM, ran SciptSentry on XP, same deal.

    So I think Johanna is right: " But it does not appear on the task manager's list of running processes, and it is not on the start up menu at all. So perhaps it just waits until it is needed, then comes to life? ".

    Off the top of my head, don't know how you would test NAV's script blocking though.

    Regards - Charles
     
    charlesvar,
    #7
  9. 2003/09/29
    Christer

    Christer Geek Member Staff Thread Starter

    Joined:
    2002/12/17
    Messages:
    6,585
    Likes Received:
    74
    Hi Charles!

    There´s always the possibility that it really works in the background and is kicked into gear when needed. Your experience seems to support that.

    If that´s the case, then I don´t understand that Symantec Support doesn´t know and inform me about the situation. Instead they send me on a wild goose chase ...... :rolleyes: ...... well, they try but I´m not running yet ...... :cool: ......

    Christer
     
    Christer,
    #8
  10. 2003/09/29
    BillyBob Lifetime Subscription

    BillyBob Inactive

    Joined:
    2002/01/07
    Messages:
    6,048
    Likes Received:
    0
    Is Norton ScriptBlocking Service similiar to this.

    Benign

    This only worls on E-mail as far as I know but has a few time filtered out some script in an e-mail.

    Every e-mail I get says at the bottom " checked by Benign " but nothing every pops up but is un a log file.

    It has an Icon in the systray. Does not show in services but does show in Taskmanager as a running App as b9.e x e.

    So am I correct that SS is a service and b9 is a standalone application ?

    miniB
    I am with you on upgrading. I upgraded to 2003 and it is sitting a a box somewhere. AVG7. Kerio Firewall and Benign have replaced it. All are doing well and no more conflicts.

    BillyBob
     
    BillyBob,
    #9
  11. 2003/09/29
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,896
    Likes Received:
    389
    I am running NAV 2004 quite happily :) - checked Services and also found that it was set to Automatic and was not started.

    However checked in GoBack and SBServer.exe has run several times during the day - seems it kicks in when needed.
     
    PeteC,
    #10
  12. 2003/09/29
    Christer

    Christer Geek Member Staff Thread Starter

    Joined:
    2002/12/17
    Messages:
    6,585
    Likes Received:
    74
    PeteC,
    thanks for letting me/us know!

    I have tried to search the logbook (Control Panel > Administrative Tools > Logbook) but on most items when I click for more information, none is available.

    Quite easy to design that Help Function ...... :D ......

    Nevertheless, it defies my logic when an automatically started sevice seems to get started and stopped by some other command.

    I´m impatiently awaiting Symantecs next suggestion ...... ;) ......

    Christer
     
    Last edited: 2003/09/29
    Christer,
    #11
  13. 2003/09/29
    charlesvar

    charlesvar Inactive Alumni

    Joined:
    2002/02/18
    Messages:
    7,024
    Likes Received:
    0
    Hi Christer,

    A possible way to test NAV script blocking, or at least to see what processes run during this test.

    http://www.rexswain.com/eicar.html This is a site for downloading a test virus file. Comes in three flavors: non-zipped - zipped - double zipped. The site's web page will explain the reasons.

    If I remember correctly, opening a zipped file involves scripting, I may be wrong about that though.

    Regards - Charles
     
    Last edited: 2003/09/29
    charlesvar,
    #12
  14. 2003/09/29
    Christer

    Christer Geek Member Staff Thread Starter

    Joined:
    2002/12/17
    Messages:
    6,585
    Likes Received:
    74
    Charles,
    Norton detected them all. I don´t know if it involved any ScriptBlocking, though. The Task Manager didn´t show the SBServ.exe.

    Regards,
    Christer
     
    Last edited: 2003/09/29
    Christer,
    #13
  15. 2003/09/30
    Christer

    Christer Geek Member Staff Thread Starter

    Joined:
    2002/12/17
    Messages:
    6,585
    Likes Received:
    74
    The next suggestion from Symantec Support:

    I haven`t had the time yet but will try to find out if I I´ve got the WSH installed or not.
    If I haven´t got it, well, then it seems like I´m not alone.

    Christer
     
    Christer,
    #14
  16. 2003/09/30
    Johanna

    Johanna Inactive Alumni

    Joined:
    2003/03/08
    Messages:
    2,402
    Likes Received:
    2
    Christer,
    Looks like they gave you a bad link, as well. But I read the entire page on scripting from M$ and didn't understand much of it. I think Symantec is trying to put it on Microsoft because they don't know either.
     
    Johanna,
    #15
  17. 2003/09/30
    Christer

    Christer Geek Member Staff Thread Starter

    Joined:
    2002/12/17
    Messages:
    6,585
    Likes Received:
    74
    Johanna,
    sorry about posting a bad link ...... :( ...... didn´t have time to do anything but a quick post.

    Same situation now, I´ll have to look into it later but my guess is that I won´t understand more than You did.

    Christer
     
    Christer,
    #16
  18. 2003/09/30
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,896
    Likes Received:
    389
    Christer,

    I guess the Scripting Host is cscript.exe - should be in system32 and system32\dllcache. At least that's how it is in my XP Pro.
     
    PeteC,
    #17
  19. 2003/10/17
    Christer

    Christer Geek Member Staff Thread Starter

    Joined:
    2002/12/17
    Messages:
    6,585
    Likes Received:
    74
    Hello all!

    It took a while but now I´ve received an explanation from someone at Symantec Support who seems to know what he is talking about:

    My conclusion is that the automatically started ScriptBlocking Service checks that all components are okey and when done, it shuts itself down.
    The behaviour is normal and by design.

    I´m glad that I didn´t start uninstalling and reinstalling ...... :) ...... and I´m sorry for blaming a possible M$ hotfix as the culprit ...... :rolleyes: ...... since they aren´t known to cause trouble!

    Christer
     
    Christer,
    #18
  20. 2003/10/17
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,896
    Likes Received:
    389
    Christer - thanks for posting that clear and definitive response from Symantec.

    Now we know for sure :)
     
    PeteC,
    #19
Thread Status:
Not open for further replies.

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...