Blink Beta 4.2.0 Feedback

Blink 4.2.3

Blue1978 — Sun, 18 Jan 2009 14:52:32 GMT

What did the release of Blink 4.2.3 consist of?

Not Seeing New "ActiveX" IPS Analyzers in Blink 4.2

Blue1978 — Thu, 18 Dec 2008 23:32:45 GMT

Nicula,

I downloaded your Blink 4.2 from the link provided in your release notes at: http://forums.eeye.com/forums/t/865.aspx

The program installed with no issues, however, the new ActiveX IPS Analyzers are not showing up under the Intrustion Prevention section of Blink like they are suppose to.

Blink Beta 4.2 Installed

Blue1978 — Sat, 13 Dec 2008 05:00:38 GMT

Well, I have Blink Beta 4.2 intalled in Windows XP in VMware. So far so good! I don't notice any changes to any menus or anything. Is the ActiveX protection changes that you made to Blink purely internal or are there other items that have changed? So far though Blink does seem smoother, not that I did not think it was smooth before on my system! I will run around some with it and see how things go and will get back to you.

Blink 4.2.0.0255 Blocks Thunderbird email

john smith — Tue, 23 Dec 2008 00:56:00 GMT

Windows XP SP3

Blink Personal Version 4.2.0, Rule version 1478
AntiVirus Version 1.0.561
Vulnerability Scanner version 5.10.6, Audits version 2013
Subscription will expire on 2009.06.21

Blink firewall prevents Thunderbird email from downloading.

In the lower left corner of Thunderbird the message "Downloading message x of y"

In the lower right corner of Thunderbird the progress bar strobes left to right

After the set timeout period (120 seconds) Thunderbird displays the message "Connection to server pop.abc.123.com timed out"

Disabling the the Blink firewall allows Thunderbird to function properly

Using the referenced method to download the logs did not work.

Installed Beta - Issues so Far..

Brent — Sun, 14 Dec 2008 08:12:12 GMT

So far the issues that were present before are still there..

And I think I found another issue..

Delayed startup - I will see the Windows warning dialog about having to Virus Program running etc just about every startup.

Also I have reproduced two times Blink Firewall blocking all internet traffic...

Maybe I need a fresh install of the software?

I am not sure at this point.... seems the same issues i have had before thou..

I will take any suggestions..

I May Have Found a Few Items in Vista that Conflict with Blink

Blue1978 — Mon, 15 Dec 2008 05:28:28 GMT

I am going to go out on a limb by saying this, BUT I may have found a few features in Vista that conflict with Blink(or so it seems they do on my system).

1. DEP - Data Execution Prevention. In Windows XP this did not give me any issues. In Vista, it clearly has been an issue for me!!

DEP has four modes:

====================================================================

A. "AlwaysOn" - The Strongest mode (you can not exclude anything from it if problems arise). Whether or not you can use this setting depends on whether or not your processor chip supports it or not.

- My old Intel P4, 3.8GHZ chip does. If you want to see if yours does, go check the following:

- Right Click Computer >> Properties >> Advanced System Settings (upper left) >> Settings button under the "Performance" section under the Advanced Tab >> Data Execution Protection. At the bottom (if it is enabled) it will normally have a little note that says if your processors supports it or not.

B. "AlwaysOff" - Completely turned off (the mode I am in now!)

C. "OptIn" - Mode that protects Windows's services only

D. "OptOut" - Protects everything on the system, but allows you to exclude programs if needed from its protection. This almost as strong as the "AlwaysOn" mode, but falls short in some way or another.

====================================================================

I first noticed I had issues with DEP when I tried logging into Hushmail that uses Java. The JRE loading in IE was setting off DEP, however, even if I disabled every single ad-on in IE (to include all of the Java ones) it did not fix anything. I even tried excluding the JRE and iexplore.exe, for the heck of it, and that did not work. The only way to fix it was to turn DEP completely off OR uninstall the JRE completely and not use it. This issue BTW never existed in Windows XP, only Vista.

==================================================

This was the DEP warning that I got when my JRE conflicted in IE and set off DEP:

Problem signature:

Problem Event Name: BEX

Application Name: iexplore.exe

Application Version: 7.0.6001.18000

Application Timestamp: 47918f11

Fault Module Name: StackHash_fd00

Fault Module Version: 0.0.0.0

Fault Module Timestamp: 00000000

Exception Offset: 0571f398

Exception Code: c0000005

Exception Data: 00000008

OS Version: 6.0.6001.2.1.0.256.1

Locale ID: 1033

Additional Information 1: fd00

Additional Information 2: ea6f5fe8924aaa756324d57f87834160

Additional Information 3: fd00

Additional Information 4: ea6f5fe8924aaa756324d57f87834160

Read our privacy statement:

http://go.microsoft.com/fwlink/?linkid=50163&clcid=0x0409

==================================================

DEP has also been blamed for a lot of Internet Explorer crashes and lockups in Vista and numerous posts on the internet can be found on it.

I think Blink somehow does not like DEP either, because if you turn off Blink, your Internet Explorer seems to function better and so forth. Well I turned off DEP and now things seem to be better even with Blink on...hence why I wonder if they have conflicted from the start.

There are two things I did that seem to help a lot of my Vista Ultimate System. You will need to do these from the Administration account if you choose to try them.

1. Disable DEP - Go to Start >> Run and then type CMD and then hit enter. You should have your black Command Prompt screen open. Enter the following into it:

bcdedit.exe /set {current} nx AlwaysOff

- (save it in a notepad or text document somewhere. This makes copying and pasting it into the Command Prompt easier)

You will now need to restart your system to make it official.

2. Disable a feature in IE - Open IE, go to Tools >> Internet Options >> Advanced Tab. Scroll down until you see the Security section and look for the "enable memory protection to help mitigate online attacks". Deselect this. Yes, I would like to leave it on, but it seems to give me problems.

The final tweak which definetly slows down your surfing is the "Protection Mode" feature in Internet Explorer. Go to the "Security" Tab in Internet Options and then look at the bottom of each of the Internet, Local Internet, Trusted SItes, and Restricted Sites sections. By default it is on for the Internet Zone and if I remember correctly the Restricted Sites zones. I have it on for all of them, but it does slow page loadin and so forth down some. There have been rumor that it stops some pages from loading at all, hence why it was not on for the Trusted Sites zone, but I have not experienced this as of yet. This is up to you, but it is another feature that affects your experience within IE.

I am curious to see if any of this helps anyone that has been having slowdown issues or lockups in IE with Blink or not. I look foward to any positive or negative feedback!!

Clarification Needed for Items in 4.2 Beta Release Notes

Blue1978 — Sat, 13 Dec 2008 02:53:24 GMT

After reading the release notes for the 4.2 Beta (http://forums.eeye.com/forums/t/850.aspx), I have the following questions:

1. " - Vulnerability Assessment reports will not display configuration audits anymore."

Is this suppose to be a noticeable change? I don't notice anything different in Retina after I do a scan. This does not mean you have gotten rid of any of the three different types of audits Retina runs on a system (High, Medium, Low) does it?

2. "- Blink will report if an incompatibility with other security products is impeding normal operation."

Will this show up as toaster style popup alert in the lower right or will it simply be a log entry in Blink?

3. " - Improved Malware disinfection. For each detected malware, Blink will scan the registry for references to the file and delete them."

I am assuming this will be automatic and it will occur after an object is marked as being malicious and is Quarintined?

4. "- IPS module includes a new Patent Pending ActiveX protection engine designed for Internet Explorer"

Outstanding! WOW, there is a longggg list of them in the IPS rules section. *Chuckles*

Please read the announcement post

lnicula — Wed, 10 Dec 2008 22:13:02 GMT

Announcement is here: http://forums.eeye.com/forums/t/850.aspx