Identity Shield and Flash Player with Pale Moon 64

Hello,

I have been having this problem for months and just today discovered what was causing it. My preference in browsers is Pale Moon 64. I have always preferred to use it 100% of the time. The problem has been that I have never been able to get Flash Player to work consistently. Sometimes it may work for a brief period of time, but the vast majority of the time it does not work. The audio portion would come through fine but the video would just be blank. So I found myself having to use IE9 quite a lot. The problem occurs when I add Pale Moon 64 to the protected apps of Identity Shield. That is when Flash Player dies. IE9 is not affected. If I remove Pale Moon 64 from the protected apps list, Flash Player works great. So my solutions are not good, add and remove PM64 from the list as I need Flash, use IE9 for Flash in order to keep PM64 protected with Identity Shield, or the worst solution of not protecting PM64 with Identity Shield. I hope this is reproducible with others and a fix can be found.....

 

By the way, here is one of the many links where Identity Shield kills Flash in PM64:

-http://www.jrmracing.com/news/2012/08/27/jr-motorsports-minute-august-27

 

I am starting to think that I am the only one seeing this issue? Or maybe only one using Pale Moon 64 with Flash?

 

I don't know if we have many users on this browser at all. You may want to just mark it as Allow on Identity Shield rather than Protect.

 

Pale Moon is a Firefox fork. Have you updated Flash within the past week to the new version that doesn't break on Firefox and (most) Fireforks? Without that update, the protection from the ID Shield breaks the connection to the moon.

 

First of all, both Flash and PM64 are updated to the most recent versions.

Now on to Joe's solution of moving Pale Moon to allow instead of protect. The way I understand this is "Protect" does just that, protects you from any identity/personal information stealing malware that may be out there. "Allow" is nothing more than an exclusion list of sorts. By moving to allow, I bypass/shut down that extra layer of protection that Identity Shield gives for these identity/personal info stealing malwares. To me, if this is indeed the case, I lose one of the most important reasons that I purchased WRSA for -its Identity Shield. And furthermore, the protection I am losing is to my browser where I bank, shop online, etc., the software that is being used almost the entire time the computer is on and connected to the internet.

To further clarify these settings, the following is taken from the WRSA User Guide/Manual:

• Protect. “Protected applications” are secured against information-stealing malware, but also have full access to data on the system. By default, web browsers are assigned to the “protected” status. If desired, you might also want to add other software applications to “protected,” such as financial management software. When you run a protected application, the Webroot icon in the system tray displays a padlock
• Allow. “Allowed applications” are not secured against information-stealing malware, and also have full access to protected data on the system. Many applications unintentionally access protected screen contents or keyboard data without malicious intent when running in the background. If you trust an application that is currently marked as “Deny,” you can change it to “Allow.”

Now here is the ultimate question: The browser is the software I use more than any other. Why should I use a security product that does not do what it is supposed to do as one of its main selling points/features: the Identity Shield? Why should I use my browser of choice that I spend more time using than any other software while it is unprotected in this regard? PM^$ is what I use and will continue to use, but if WRSA will not protect me as advertised as far as the Identity Shield component, Should I keep WRSA?

I like WRSA but I like my browser. If I have to turn off a main protection module in regards to WRSA in order for my browser to work properly, I am afraid it may be time now to look elsewhere for a product that will give me the protection I need.

In a footnote, I am surprised that Joe advised me to basically turn off Identity Shield for my browser. For me, This is unacceptable. If Identity Shield cannot give me the protection that was advertised and I purchased it for, time to move on. I, personally, thought this would be a bug to be fixed as it is not like the padlock disappearing or the web site green/red arrows now showing up during searches, this is a real lowering of the effectiveness of WRSA to protect me to the extent is is supposed to...

Pardon my ramblings here, I need to vent my thoughts.....

 

You cannot pretend WSA is compatible with 100% browser out there. Too many to enumerate. Its already a major work to keep up with all browsers updates... WSA cover the most widely used. I would personally suggest that either you drop WSA or move to a supported web browser.

 

I have already uninstalled WRSA and advised the same to my friends here with same problem. The solution I have installed in place of WRSA is working fine and I am actually surprised it has less impact on my system too.

I apologize for my rant but so many other vendors offer a product that works in my situation, it is just a shame Webroot's answer is instead of making it work is to bypass it instead.

I think Webroot seriously should have a list of known incompatibilities with other softwares (if they already do not have it as I could not find, if they do have a list then it need to be more accessible) published on their website. They work very hard making WRSA compatible with almost every other security software out there, it is a shame they do not the same with browsers. And like I said in my first post, this bug has spanned many many versions of WRSA, Flash, and PM64 over quite a few months.

 

I really hope my suggestion wasn't taken the wrong way. We strive to protect every application and work properly with every piece of software. If you aren't able to use the browser when under "Protect", I was looking to see if it even works when set to "Allow". We will of course want to fix the issue, but we need more information to do so.

We have to focus on fixing issues that affect the widest customer base first and there is a lot of work on going for the Fall release and other changes. I'm not aware of any other user having any issue with Pale Moon but if you could try it again and get us more information (other security software/exact builds/OS/SP/etc), that would definitely help.

 

I was gonna say...

I can only make educated guesses on things, and Joe (PrevxHelp) is the VP of Development for the program, so he doesn't always have the time with all the work he does on making the program work to get a full post in.

Allow instead of protect is a temporary workaround, especially seeing that PM is so rare, so they have to fix the stuff that affects a lot of people first.

So, next question, was anything listed in "deny" on the protected applications list, and how many items were listed in the scan logs as at the start of the line? Firefox uses a plugin container, for example. If PM does the same thing, but the plugin container process is untrusted (Deny or known), it will be prohibited from interacting with the main browser process properly to protect the browser from it.

A deny is solved by moving the item to allow (Things that you trust should be allow or protect, not Deny). PM stuff in or necessary things in is solved by Threat Research.

 

Hello,

If I took it the wrong way, it was that the "allow" was the solution. Since that is not the case, I may have reacted to my misinterpretation of your response, and for that I apologize.

As for what I am running, this has been an ongoing problem for several months, and during that time I have had it down to nothing but WRSA and the Windows firewall several times including this morning. I have used other security software from time to time along with the above, but since I have had it down to only WRSA and Windows Firewall with the problem still there, I think that gives a good starting point.

Since it has been ongoing for several months, it has included many versions of WRSA, Flash, and PM64 (both stable and beta versions of all three). As of this morning WRSA was 8.0.1.231 (stable), Flash (11.4.402.265 (stable), and PM64 (15.0-x64 stable). At the time I had no other security softwares running and had shut down all processes that were not essential to those softwares or the system. My OS is Windows Vista Home Premium 64 bit service pack 2 with all hot-fixes up-to-date.

With the above setup that I had this morning, with PM64 on Identity Shields protection list as "protect", I had the problem of only audio, no video. Removing PM64 from the list allowed both audio and video to work. I did not try to "allow" because in essence I thought it was the same as removing from the list. This problem like I have said has been ongoing and been occurring with many different softwares including security softwares. But I did have it down to the barest minimum of softwares and processes this morning trying to narrow it down as much as possible.

The only other thing as far as plug-ins or extensions that I use on PM64 besides Flash is Java SE 7 U6 10.6.2.24 and PassIFox 1.1.5.

I hope this gives you enough to work with because I am not sure I can narrow it down much further. Also know that the setup I had this morning when making these observations has been totally changed and for the moment WRSA is not installed.

Thanks...

 

I always check to see what IS has added to its list, so no denies in any list. Those get checked daily if not twice or more since I install and uninstall a lot of different programs.

Keep in mind that "allow" is basically an exclusion and turns off basically whatever protection that the particular list is for.

 

Hi Kent,

Just to be clear can you save a scan log to see if any parts of PM have a in front of it or being Monitored? As for me I always have Firefox being Monitored and I don't think it should be but I could be wrong maybe Joe can clarify?

Tue 28-08-2012 16:34:28.0783 Monitoring process C:\Program Files (x86)\Mozilla Firefox\firefox.exe [3F677172F23FC17283D9BCE4B42E3F65]. Type: 1 (9113)

TIA,

Daniel

 

Hi Daniel,

Come to think of it, PM64 may have been monitored, I do not remember for sure. I have had some cases of processes being monitored that have caused problems and I have had to allow the process. Does this shut off all protection including IS if I do this? On the other hand I have run other versions of PM64 that were not monitored and still had the problem. I do remember I had 11 processes that were being monitored. As I said in above post, WRSA is not on my system now so I will have to install and check these items out for sure. Give mna a little bit of time and I will check.

 

I was hoping for Joe to make a comment but to find out Contact the WSA support inbox so they can look at your logs and make possible determinations!

HTH,

Daniel

 

I have reinstalled and done some tests. PM64 and it's plug-in container are both being monitored. Removing them from the monitor list and changing to "allow" has no effect under "Control Active Processes". Going to the Identity Shield list, "Protect" breaks Flash, but ether changing to "Allow" or removing from the list entirely "fixes" Flash but at the same time shuts off the IS protection to PM64. So I believe the problem is only in the IS protection and does not involve the fact that control active processes is monitoring PM64. I am also sure that I have run versions of PM64 that were not being monitored and still had this same problem.

There are only the three commonalities I can find: WRSA Identity Shield, Flash, and PM64.

 

Please contact WSA support as I suggested above for they can have a look at your logs and even point them to this Thread!

TH

 

Done...

 

Hello,

Webroot Tech Support went over my logs and made necessary adjustments to their white-list. I now have no programs being monitored by WRSA. However, the Flash problem is still there.

 

So everything else works now except Flash? Do you have a lock on the Tray Icon when on HTTPS sites?

TH

 

It is still the same problem of the three softwares together, nothing has changed, when Identity Shield is protecting PM63 Flash is broken. Remove PM64 from IS protection and Flash works fine. It is something in the combination of the three.

And yes, when IS is protecting PM64 I have the padlock, but of course since PM64 has to be added to thee protection list, the padlock is there for all sites, both HTTP and HTTPS.

 

Can you check to see if WSA's Firewall is blocking Flash Plugin from this Directory and I know your using Vista!

 

No, it is not being blocked and even if it was, how is the video blocked but not the sound? And how does turning off IS protection allow it to work. IS is somehow blocking the video but letting the sound through.

 

I'm just trying to look at different avenues but I guess with no luck! So we will see what Joe has to say?

Thanks,

Daniel

 

You are a help as always!!! Thanks!