Blink 4.0 Feedback

Thunderbird Portable -- Firewall Rule #2, #3, #n not created

Jmtyra — Mon, 02 Jun 2008 15:27:46 GMT

Hi -- I use Thunderbird for my email client (portable edition, on a local drive) and it seems that Blink cannot create subsequent rules for the Thunderbird application. The first rule will create when prompted, however; when another rule prompt is shown (for example, Thunderbird using a different outbound port) and 'allow/create permanent rule' is chosen, the rule is not created within Blink.

However, if I manually edit the existing rule to match the port ranges desired then it works normally.

For information about the 'portable' edition of Thunderbird:

http://portableapps.com/apps/internet/thunderbird_portable

Please note, this is *not* being ran from a memory key but instead is being ran locally...

Possible Norman AV False-Positive (Pidgen Portable)

Blue1978 — Mon, 12 May 2008 20:20:04 GMT

I may have found a false-positive with the portable version of "Pidgen" from http://portableapps.com. I have submitted the following trouble ticket for follow-up.

Ticket ID:

TK031307

Created On:

5/10/2008 7:02:06 PM

---------------------------------------------------------------------------------------------------------------------------------------------------------

Communication History

On 5/10/2008 7:02:08 PM you wrote:

While installing the Portable Application "Pidgen" from PortableApps.com, Blink alerted me with the following alert:

-------------------------------------------------
Event ID: BLINK-MAL-205
Severity: High
Description: Blink has found a malware application
Virus found: Vundo.gen42
Item found: I:\PidginPortable\App\GTK\lib\gtk-2.0\2.10.0\engines\libthinice.dll
Action: Quarantine
Alert: Yes
Name: Vundo.gen42
Second Action: Log Only
Category: Trojan

Event ID: BLINK-ENG-202
Severity: Medium
Description: Blink has disinfected the system after malware was detected
Quarantine Location: 01C8B304-D4C6B9F6-0-Vundo.gen42
Action: Quarantined
Item Found: I:\PidginPortable\App\GTK\lib\gtk-2.0\2.10.0\engines\libthinice.dll
Alert: No
Name: Vundo.gen42
----------------------------------------------

This seems strange and would like to confirm whether or not it may be a false-positive or ligitament alert that I need to tell the portableapps.com website about.

I have included the Portable executable in the zip file "Pidgen.zip". The password to access it is "Blink".

Thanks in advance

On 5/12/2008 9:18:52 AM eEye Digital Security wrote:

Hello Jeffery,

I downloaded this file, and scanned it with the latest virus database, and it came back clean. Can you update your Blink and try to scan it again for the presence of this malware?

Thanks,
Dennis A.

On 5/12/2008 11:15:33 AM you wrote:

I tried that too, but the only way to get the alert is to install it on a USB device (as I was at the time). It triggers on one of the .dll files (libthinice.dll ) during the installation (or in this case the extraction process of the executable on to the USB device).

I will update this post as eEye provides me further details.

Windows Problem Reports and Solutions - Service Hang Report

SpacePilot — Fri, 25 Apr 2008 15:06:08 GMT

Here is another related Problem Report, this one relating to a Service Hang rather than Compatibility. Hope this helps.

Product

eeyeevnt

Problem

Service Hang Report

Date

4/21/2008 3:27 PM

Status

Not Reported

Description

Service eEye Application Bus hung on starting.

Problem signature

Problem Event Name: ServiceHang

Service Name: eeyeevnt

Image Name: eeyeevnt.exe"

Image Version: 0.0.0.0

Service Type: 10

Start Type: 2

OS Version: 6.0.6001.2.1.0.256.1

Locale ID: 1033

Files that help describe the problem

Version.txt

minidump.mdmp

Version.txt:

Windows NT Version 6.0 Build: 6001 Service Pack 1
Product (0x1): Windows Vista (TM) Ultimate
Edition: Ultimate
BuildString: 6001.18000.amd64fre.longhorn_rtm.080118-1840
Flavor: Multiprocessor Free
Architecture: X64
LCID: 1033

Minidump.mdmp:

I can not open the Minidump, and can't seem to attach it as a file. Please let me know what e-mail address to send the related minidump file to.

Don

Vista Install Fails - VISTA Business with SP1

Patto — Mon, 17 Nov 2008 06:48:49 GMT

Set up a new laptop, uninstalled Windows Live OneCare, rebooted, then tried to install BLINK Personal 4.1.3

Appeared to load, bought up the BLINK Control Console, displayed "Blink Services starting ...", then "Intializing Protection engines..." . BLINK then sent my hard drive into a frenzy, nothing seemed to respond, and eventually the cursor would not move .. the laptop all locked up.

I started in SAFE MODE and restore to a Restore Point just prior to installing BLINK and tried again ... still the same.

I had to restore to the point prior to the Windows Live OneCare uninstall, to get the Laptop going.

Is there a fix for this issue that stops me installing BLINK Personal 4.1.3 in a VISTA SP1 environment?

Windows media player

wildtiger23 — Sun, 30 Mar 2008 15:34:29 GMT

Application protection : Application alert

2008-03-30 11:21:49

Event ID:	BLINK-APP-100
Severity:	High
Description:	Blink detected a suspicious system call.
Reason:	KERNEL32.DLL!CreateThread
Action:	Terminate Process
Program:	C:\Program Files (x86)\Windows Media Player\wmplayer.exe
Alert:	Yes
Note:	Blink detected an abnormal behavior in one of the monitored applications. It is very likely that you are witnessing an attempt to exploit a known or unknown buffer overflow vulnerability in this application. The best course of action is to update this application to the latest version available from its vendor. Also, please report this issue to eEye to be investigated further. If you are sure that this is not an attack, you can disable the Application Protection layer for this application by editing the apiex.ini file in the Config folder under the Blink installation directory. To add an exclusion for this application, open the file in notepad or your favorite text editor and add a line in this format: PROCESS_NAME;;Kevlar;0 Replace the PROCESS_NAME entry above with the .exe name reported above in this event. For example, to exclude notepad.exe create an entry like this: notepad.exe;;Kevlar;0

Your are asking to report this but your aren't saying where.

Error report

cat_bastet — Sun, 12 Oct 2008 18:35:39 GMT

Since i upgraded to Blink 4.1.1 a couple of days ago I have received the following error 5 times:

Event ID:	BLINK-APP-100
Severity:	High
Description:	Blink detected a suspicious system call.
Reason:	Attempting to infiltrate Kevlar memory
Action:	Restart process
Program:	C:\Games\WoW\Wow.exe

It shuts World of Warcraft down completely, and suggests reporting the issue to eEye. I didn't see anything on the site showing how to report errors so i'm posting it here

Blink 4.1 has been released

lnicula — Sat, 06 Sep 2008 02:42:01 GMT

Hi all,

We are proud to announce the release of Blink 4.1. For release notes and download link please see the Announcement

For the time being 4.1 is only available as a full installer. The automatic update will be live early next week.

Enjoy!

Blink 4.1 Shutdown Stall (Vista 64-bit)

c4p0ne — Fri, 19 Sep 2008 08:14:25 GMT

When attempting to shutdown blink completely from its GUI, the process stalls 10 out of 10 times. Interesting to note is that -again- this seems to happen after blink has processed traffic (any traffic) for a short time or during traffic processing. When the GUI/Service stall, I must manually terminate the service component, which of course then restarts itself.. Once the service does restart itself and I manually start the GUI, I can shut it down normally from the GUI only if I do it *immediately* after the process/GUI have "freshly" started. This is what causes me to believe that this problem happens only after Blink has been running and/or processing traffic for a while on 64-Bit Vista (SP1).

Also there are "quirky" network connectivity issues on 64-Bit Vista. Namely, webpages and the graphics on them seem to not load properly much of the time. In other words, many/all images on a particular page will load but never finish loading completely, leaving them all "chopped". I'm not sure but the problem "seems" to be more pronounced in Firefox then in IE, however it is certain that Blink is the culprit, I just dont know which component is to blame. I believe there is a high probability that eeyetv64.sys & eeyehv64.sys are not functioning correctly.

Blink 4.1 Firewall Blocking Access to iTunes

calvinhrn — Tue, 09 Sep 2008 02:37:45 GMT

This may be a bit of a petty thing, but the firewall or something in Blink 4.1 under Vista is blocking me from accessing the iTunes Store and is making it a royal pain to try and update podcasts (and what's a week in podcasting without hearing John C. Dvorak rant on TWiT?). I've narrowed it down to Blink or one of it's components because when the Blink application itself is disabled I can access iTunes fine, however with the application active, generally with any of the System Protection, Intrustion Prevention and Firewall modules in varied combinations of enabled/disabled gives varied results.

Blink 4.0.4 on Server 2008

fishermc — Fri, 05 Sep 2008 18:08:09 GMT

I am getting high CPU uage from blinksvc.exe on a Server 2008 (Virtualized on ESX) install. Anyone else seeing high CPU usage on Server 2008?

Spiceworks v3.1 BSOD with Blink+Vista64!

c4p0ne — Fri, 22 Aug 2008 18:58:03 GMT

Try it, if you dare!

Blink NOT In Systray & Blink Doesn't Recognize the Fixes I installed

Winifred — Thu, 21 Aug 2008 21:08:21 GMT

Hi, noobie here. Love Blink. Am frustrated however that despite @ I've done to have it happen - Blink icon does NOT sit in systray after a hard boot on my Vista. I need to double click on it in Program Files, get 'authorization' (even though I am the administrator) and then it finally appears in systray - after its flash screen appears that everything is working properly. Any help with this issue?

Is Blink active and working even though it's NOT in the systray?

2nd problem: Blink fix to "Upgrade to Adobe Flash Player to 9.0.124.0" was installed - but Blink still shows it as a needed fix, with HIGH RISK. Any help?

3rd problem: Same as #2 but for "Update of Foxit Reader to version 2.3 build 2923 (2.9.2008.2923) or newer" - which I installed but Blink still shows it as needed; again with HIGH RISK. Any help?

Thanks for any assistance.

eeyeevnt service hang report

c4p0ne — Sat, 16 Aug 2008 11:24:50 GMT

There's my dump.

http://rapidshare.com/files/137721113/eeyeevnt-servicehang-minidump.rar

Also, I'm experiencing what I call a "100% showstopper" issue on 64-bit Vista. I've got 100% pure 64-bit versions of Apache (2.2.9), PHP (5.2.6), and MySQL Community (5.0.x) serving pages off of my local machine. They are apparently incompatible with Blink since the moment somone acesses a simple php page from outside the machine absolutely completely freezes. Zero activity, frozen mouse and keyboard, no dumps whatsoever, requires a cold reboot from the main power switch. So far I've tried upgrading/downgrading Marvel drivers, changing the settings of those to be "safer", disabling all components except IPS in Blink, but none of those are fruitful in the least. As soon as access happens from outside to the server, temparature hits absolute zero.

Oh and of course when I "shutdown blink personal", ALL php pages, scripts, database access return to 100% normal. No crashes, slowdowns or genaral problems whatsoever. In other words as soon as blink is shutdown, I've got a fully 64-bit working apache64+php64+mysql64 site.

41 Trojans?

getemnow — Fri, 18 Jul 2008 20:38:19 GMT

Re: Blink Personal. Since 7/12/08 have spent approx. 9 hrs. scanning all
partitions and have found 8 Malware and 41 Trojans. With Blink Personal
always running, why are so many malware and trojans getting through your
software? I thought the S/W was designed to prevent entry to the hard
drive. Please advise. This seems to be an unusually high number of
Trojans in this short a time period.

Vista 64-bit | Blink appears normal but completely fails to actually perform firewalling/ips.

c4p0ne — Wed, 25 Jun 2008 17:30:29 GMT

Can someone please tell me what steps I can do to send eeye the nesessary information (blink logs?) so that they can determine why this is happening? Blink seems to be functioning normally except for the fact that it DOES NOT ACTUALLY BLOCK ANY TRAFFIC. No the firewall/ips is NOT set to passive mode. The system is X38 Chipset, Vista64 SP1, Atheros Wireless Drivers (Netgear WPN311 card), Marvel LAN Ethernet adapter. It functions, ALERTS SOMETIMES come up offering an action (create rule etc.), but that action is NEVER acted upon (e.g actually blocked).

Its driving me crazy.

Blink Kills PC Probe v1.0

JayEff — Mon, 07 Jul 2008 16:32:49 GMT

Well today I decided to retry the firewall and lo and behold. Within MINUTES blink crashes my TCP/IP stack and I lose any app layer connections. All l2 or l3 connections are still fine and working (pings, traceroutes), but nothing else works. DNS does not move, HTTP does not move, etc. etc.

Blinksvc is consuming nearly 100MB of memory at boot up. no scans are active.

Could not restart TCP/IP without a reboot. Before the reboot I noticed this app 'PC Probe' is failing at startup. If I disable the firewall AND Anti virus this works fine, but otherwise as soon as I try to reenable blink protections, the app fails. "Abnormal program termination".

Fragmentation is light, as the drives were defragged next week.

eEye Webmaster where are you?

wguru — Mon, 09 Jun 2008 08:36:09 GMT

Experienced a problem when trying to return to an eEye forum/forum article I'd saved as an IE Favorites.

Apparently due to the website's inability (Webmaster's design) to 'parse' such URL's to a particular forum or article, users are then unknowingly later led to an eEye webpage that users cannot get to the forums from.

This page (an expected 'favorites') ...

http://www.eeye.com/~apps/modules/forum/forums.asp

..apparently results when a user(s) save an eEye forum page. From that eEye webpage, users cannot access the forum as it seems the resulting links from that page (for the forums) gets users to a dysfunctional eEye webpage (see below and screenshot).

As such, it seems evident that the eEye Webmaster needs to know that there is an issue with eEye's website, predominately involving forum access.

Kindly note that the above webpage's links to the forum's, results in the following URL's dysfunctional webpage, apparently due to the eEye Webmaster having yet to recognize users are saving forum URL's and the website seems to not be capable of handling some or all of those URL's.

Note that once the user is at the above webpage, then clicks any of that page's forum links, it gets the user to a totally dysfunctional webpage, including failure to disclose that the page is 'broken' or has some other issue.

That webpage (below) is dysfunctional in nearly every manner and also seems to fail at properly displaying it's graphics as the only ones displayed are the dropdown menu buttons and the "vulnerability management solutions" text and it's artwork.

All other graphics (photos) have that small white square with the red "x" in it. Those sections are blank, and even right clicking the x's, still don't display the area pictures/graphics.

http://www.eeye.com/~apps/modules/forum/threads.asp?cat=t%2E060714%2E144048%2E921061&filter=1

As such, its clear that the Webmaster needs to fix this, assumedly to account for the eEye website being incapable of handling user's 'favorites' for forums/forum articles.

Lastly, in that the webpage seems useful (if it worked), not only do I fail to find a link to it, nor when I am at it, doe sit work. So why isn't it being fixed, provided with an advisory that it's 'still under construction' or else taken down?

Oh yes, for those also experiencing this issue, here's the link to the forum's so you don't have to drill the home page for some 3 or 4 pages and links to get at least to a page that you can back your way into one of the post's forums, here that is.

http://forums.eeye.com/

And as for how one gets to a working forum 'home', I have no idea how that's duh'n. Yes I know, seems it should be simple enough, but I don't see it.

While I'm on my soapbox, another issue albeit minor is that once readers are at certain pages (all those stemming from 'Home' at http://forums.eeye.com/forums/), I see no reason for all resulting pages to thereafter redundantly include the "Forum" link that sits to the right of the 'Home' link, because all that does is refresh the page your on (Discussions, etc.).

Best regards and hap-e-er-e-trails,

wguru

Blink kills WMPlayer

Dezl0ck — Thu, 26 Jun 2008 00:18:44 GMT

When plugging in a windows mobile device, Windows Vista x64 attempts to launch WMPlayer and is killed by Blink. A rule can be added apiex.ini, but since this is normal behavior it would be nice for Blink to look a little deeper into what is actually going on with the system. I believe if you plugin a Windows Mobile device it assumes you are syncing a portable music player. I don't have a Zune to see if the same thing happens, but I'm willing to bet it would happen with that device too.

Event ID:	BLINK-APP-100
Severity:	High
Description:	Blink detected a suspicious system call.
Reason:	KERNEL32.DLL!CreateThread
Action:	Terminate Process
Program:	C:\Program Files (x86)\Windows Media Player\wmplayer.exe
Alert:	Yes
Note:	Blink detected an abnormal behavior in one of the monitored applications. It is very likely that you are witnessing an attempt to exploit a known or unknown buffer overflow vulnerability in this application. The best course of action is to update this application to the latest version available from its vendor. Also, please report this issue to eEye to be investigated further. If you are sure that this is not an attack, you can disable the Application Protection layer for this application by editing the apiex.ini file in the Config folder under the Blink installation directory. To add an exclusion for this application, open the file in notepad or your favorite text editor and add a line in this format: PROCESS_NAME;;Kevlar;0 Replace the PROCESS_NAME entry above with the .exe name reported above in this event. For example, to exclude notepad.exe create an entry like this: notepad.exe;;Kevlar;0

Blink bugs still not fixed from 3.5

JayEff — Thu, 19 Jun 2008 17:29:57 GMT

Explorer crash due to kevlar. This is very troublesome because explorer is then restarted but comes back as SYSTEM instead of user. This creates an exploitable (and incomplete) desktop.
Complete adaptor hang due to no free buffers on stack being overwhelmed by BLINKS slow analysis engine, run utorrent for 24 hours with 300 DHT's, and blink will kill the network freezing all traffic, but still logs connections. BLINK and bittorrents are incompatible. This is the ONLY firewall I know that has a problem with this. ZA, Comodo, SS, IPTABLES, all work fine even with two times the DHT's.
Firewall disabling generates VC++ redist library crash, and hangs a thread with .net 2.0 forcing a reboot.
No dumps or traces are produced in DEBUG mode. ??? Eh ??? shouldn't it?
Network problem only crashes other applications such at Firefox when they attempt to start in this condition. This results in a very unstable desktop. Removal of BLINK, and all problems disappear.
Beta or not, these problems have not been addressed since I originally reported them back in 3.5 and prior periods

Other issues

Lack of detail in logs. In event viewer view most entries look the same from the same engine (more detail pertinent to the entry especially for firewall rules)
Large logs are very unresponsive and cause time outs
Inability to get broadcast traffic and multi-cast traffic to abide by rules. Unless added as a trusted IP all traffic gets handled inappropriately.

From a security perspective I think TRUSTING a broadcast address is like trusting a server on a DMZ. Foolish beyond beleif.

Many of these I have mentioned over 6 months ago, with no resolution.

PC-Cillian has no troubles on a equal machine. F-Secure IS has no troubles on a equal machine.

Numerous direct emails with Laurentia has not resulted in resolution or fixes in the above.

How to make Blink unstable.

JayEff — Mon, 30 Jun 2008 13:56:11 GMT

All with 4.0.1 release.

Two things I have found that can really affect performance on Blink.

1. DoS - From a shell start 'sfc /scannow'. On a 3GHZ Dual Core it consumes over 25% of CPU. On a older P4, it consumes all CPU, virtually hanging the machine. Deactivate 'Virus and Spyware', machine restores responsiveness. I would guess this is a lack of trust affect.

2. Unresponsive threads - Typically due to large fragmented logs. Attempts to defrag filesystem will result in unstable Blink. There does not seem to be any limit to the amount of fragmentation. Any files over 10MB in size and broken into several parts will result in Blinksvc consuming massive CPU. I find any defragmentation done to the 'programs' drive forces a reboot to restore responsiveness.

4.0.1 install fails - internal error

Howard — Fri, 20 Jun 2008 18:17:17 GMT

I'm stuck... I tried to install Blink 4.0.1 which failed with the message "Internal Error 2721. RemoveKey_Personal". I then tried to uninstall Blink and got the same error. The last actual Blink install was beta 3.5.0 and 3.5.1. The current Blink Personal version is 3.5.7.

Intrustion Prevention disabled when Blink starts up

mid — Tue, 03 Jun 2008 02:54:04 GMT

When I first start my computer and Blink starts up I always have to manually go into the Blink control panel and turn on Intrustion Prevention. Has anyone else run into this problem? If so do you know a workaround? I'm running Windows XP SP2.

4.0.1 - exist or vaporware?

JayEff — Wed, 04 Jun 2008 18:05:23 GMT

Someone had mentioned that this version was out, but I cannot upgrade to it. Is this a beta release?

Windows is blocking a startup application (Blink)

SpacePilot — Mon, 07 Apr 2008 21:50:49 GMT

I get a message that "Windows is blocking a Startup Program". Blink will not start, and is listed as the Blocked Program.

Blink loaded fine at boot the first few times, but now after several days away when I try and boot I get this message. I was unable to capture a screen snip of that as it dissappears within a few secongs, and the pop-up from the taskbar dissapears as soon as I try to open the snipping tool, but it displays an option line to run the Blocked Program. I then click on the only blocked program that appears to the right, that being Blink. The window dissapears, but Blink never seems to appear in the "Task Manager" as a running process.

I then have to manually open Blink from my Start Menu in order to get it operating. It would be easy to think that you had in fact started Blink when you clicked on the option to run the blocked program, and then be running naked without Blink protection. I did capture some screen shots but can find no way to attach them to this post, so if someone needs them to analyze the problem let me know and I will email them directly to you. The help screen on the Blocked Program window says I will have to repeat the process each time I start the blocked program, no option I can find to allow it in the future. It seems to be Windows Defender doing the blocking, Windows Defender having become active after I uninstalled Windows Live 1-Care (Hated it, but just running free trial version until Blink 64K Vista came out).

Am thinking I will probably want to disable Windows Defender somehow, as I'm pretty sure Blink covers all the functions Windows Defender does.

It does show that it is "Windows Defender" blocking Blink, and showing it as "Classification: Not yet Classified". I find no option to tell Windows Defender to allow Blink in the future. Perhaps this will cure itself on the next start as Windows Defender just downloaded new definitions. Any advice before I try and figure out how to disable Windows Defender?

Addendum: Windows Defender blocked Blink on the next boot, so they haven't yet fixed the definitions or the Classification of this program. When I clicked the link to open the blocked program, I got the message "An invalid command line parameter was specified". That is probably a Windows Defender problem, but it forces me to then go and start Blink from my Start Menu in order to have Blink running and protecting the computer.

Windows Mobile Device Center Blocked by Blink 4.0.1

Dezl0ck — Tue, 10 Jun 2008 22:09:29 GMT

This was an issue in the Beta and is still around in 4.0.1 on 64-Bit Vista.

To reiterate, Blink on Windows Vista does not allow a Windows Mobile Handheld to connect. I have added an application rule for %SystemRoot%\System32\mobsync.exe and it is allowed to connect to anything along with C:\Windows\WindowsMobile\wmdc.exe (Windows Mobile Device Center) and C:\Windows\WindowsMobile\WmdHost.exe (Windows Mobile Device Center Sync Host).

In other testing I have managed to get WMDC to connect if I have Antivirus and System Protection enabled. If Intrusion Prevention or Firewall is enabled the handheld does not connect. There are no unusual entries in the Blink logs to indicate that anything is being blocked.

Blink Personal Version 4.0.1, Rule version 1446
AntiVirus Version 1.0.408
Vulnerability Scanner version 5.9.1, Audits version 1907
Subscription will expire on 6/3/2009

The application log recorded this event when plugging in the device.

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
    <Provider Name="RapiMgr" />
    <EventID Qualifiers="49152">6</EventID>
    <Level>2</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2008-06-08T16:16:34.000Z" />
    <EventRecordID>6923</EventRecordID>
    <Channel>Application</Channel>
    <Computer>odin</Computer>
    <Security />
</System>
<EventData>
    <Data>
    </Data>
</EventData>
</Event>