Jump to content
GmbH

Cannot disable Content Blocker KAV plugin - KIS 2015 keeps requesting non-existent URL's

Recommended Posts

Hello,

 

I'm developing local site, during testing it with WebDeveloper tools I've noticed that KIS 2015 is repeatedly requesting nonexistent URL's. After some debugging I think that this is caused by "Content Blocker KAV" plugin (DLL) which inserts "main.js" script to page header ("main.js" script contains “KasperskyLab.AntiBannerInstance” phrase). I also cannot disable this plugin because it keeps re-enabling.

 

Sample inserted tag:

<script type="text/javascript" src="/6F6582DAC82A466FB2604FD992525690/F617623D-8CD0-6846-86F5-46331A86DE17/main.js" charset="UTF-8"></script>

 

Sample requests to nonexistent URL:

http://192.168.1.30/09F54E0B-E846-4241-B64...331A86DE17/from

 

Any ideas how to turn off this plugin?

 

Best regards,

 

Share this post


Link to post

This is not caused by Content Blocker plugin. Please try to disable Anti-Banner in KIS settings.

Share this post


Link to post
This is not caused by Content Blocker plugin. Please try to disable Anti-Banner in KIS settings.

 

Antibanner is disabled in KIS settings, all KIS addons (XPI) are disabled in Firefox, only KIS plugins (DLL) are enabled in Firefox (and I can't disable them, after restart they are enabled again). KIS is updated to latest version 15.0.1.415 (B.).

 

Best regards,

 

edit: (b.) sted cool.gif.

Edited by richbuff

Share this post


Link to post

Plugins cannot be disabled, but as I said they should not cause the problem.

 

It is either Anti-Banner or URL Advisor. URL Advisor only works with search engines by default (see Settings -> Protection -> Web Anti-Virus -> Advanced Settings).

Share this post


Link to post
Plugins cannot be disabled, but as I said they should not cause the problem.

 

It is either Anti-Banner or URL Advisor. URL Advisor only works with search engines by default (see Settings -> Protection -> Web Anti-Virus -> Advanced Settings).

 

I've turned off URL Advisor - nothing changed - KIS still is requesting the same non-existent URL. Here is a paste from injected main.js: http://pastebin.com/7UQDVYSE

Share this post


Link to post

Hello Everybody,

 

after upgrade from KIS 2014 to 2015 (I use 15.0.1.415(B)) I observed that there is additional JavaScript file added to any website I open. Its path is random, but it always looks similar to:

 

<script type="text/javascript" src="/EEB4FF07C859475CAF6B47CBC4A62730/EC25883A-0192-E648-9157-11BB9C786E53/main.js" charset="UTF-8"></script>

 

I'm sure it's added by KIS, because inside it starts from:

(function(){
var KasperskyLab=function(e){function l(a)...

 

I have two problems with this fact. First of all there is no way to get rid of this code. I tried to disable all protection mechanisms one by one. Even if all of them have been disabled, the code was still there. I had to completely disable the whole KIS to get rid of it. I think this should not be the case. There should be option to disable this behavior.

 

Second thing is that this JavaScript keeps trying to make some HTTP requests (many of them, in fact). And the surprising thing is that all of these requests are blocked by KIS itself! Does it make any sense?

 

Is there any way to get rid of this JS code without downgrade to KIS 2014?

 

I'm attaching some screenshots of HTML and JS code + debug info of these requests.

 

Regards,

KS

post-537884-1417693085_thumb.png

post-537884-1417693088_thumb.png

post-537884-1417693092_thumb.png

post-537884-1417693095_thumb.png

Edited by sowiq

Share this post


Link to post

Similar, but not exactly the same. I was able to remove all KIS plugins from Firefox and Chrome. But KIS still keeps adding its code to pages.

 

Yes, looks like it's the same problem.

 

BTW, I don't think it's good idea to install to all browsers stuff (e.g. 3 new plugins to Firefox) which changes look of web pages without even asking user or at least giving option to not install them during KIS installation process.

Edited by sowiq

Share this post


Link to post

I'm experiencing the same problem. I tried to disable all protection mechanisms one by one. Even with all of them turned off problem still exists. The only way to get rid of the code is to completely disable the whole KIS.

 

 

Share this post


Link to post

If Anti-Banner and URL Advisor is turned off, there should be not scripts injected into the webpage. Please make sure that you reload the page after making the changes and that you do not get a cached copy of the webpage.

 

Have you or another user on your computer used Anti-Banner in the past? You can try to restore the default settings for Anti-Banner (Settings -> General -> Manage settings -> Restore settings).

 

By the way, those requests are not actually blocked by KIS. The requests are answered by KIS and do not reach the visited website. This mechanism is used for letting the injected script communicate with KIS.

Edited by JanRei

Share this post


Link to post

Anti-Banner mechanism has been completely disabled on my computer. All its options are turned off and the whole protection mechanism is also turned off.

 

I also tried to turn off all protection mechanisms, but the only way to get rid of the additional JS code is to completely disable the whole KIS.

 

I didn't only refresh the site, but also restarted browser. I also tried it in 3 different browsers - Chrome, Firefox, IE. In all of them result is the same all the time.

 

Like author of this thread, I was able to disable all add-ons from Firefox installed by KIS. But I'm unable to do the same with 3 plugins:

- Content Blocker KAV, 4.5.3.8, npcontentblocker.dll

- Online Banking KAV, 4.5.3.8, nponlinebanking.dll

- Virtual Keyboard KAV, 4.5.3.8, npvkplugin.dll

 

Interesting thing is that I don't have any additional plugins in Chrome or IE.

 

I'm attaching screenshots of KIS options. I use Polish interface language, but it should be quite clear. First one is list of services with Anti-Banner turned off. The second one are Anti-Banner's options - all of them are disabled.

post-537884-1417708937_thumb.png

post-537884-1417708941_thumb.png

Share this post


Link to post

I just noticed another interesting behavior. Anti-Banner mechanism in my KIS is supposed to be disabled (as per my screenshots from previous post), but it still messes up with HTML code. Please take a look into attached image.

post-537884-1417722111_thumb.png

Share this post


Link to post

Did you try to restore the Anti-Banner settings as described in my previous post?

 

If this does not help the only suggestions I have are to re-install KIS or to contact support.

Share this post


Link to post

@JanRei, I just restored Anti-Banner setting like you described and looks like it helped. No additional script has been added so far. Thank you for your help! :beer:

Share this post


Link to post

Developers changed the way Anti-Banner works in MR1 release aka KIS15.1.415: it doesn't use browser extensions now and blocks ads in some other way. I created a thread in Russian forum trying to figure out how exactly ads are flitered but didn't get a clear explanation. It looks like OP found an answer!

 

Also, you can disable KIS plugins: go to your FF profile directory and delete user.js. This file is created by Kaspersky and contains a couple of preferences that activate KIS plugins. You can open it with Notepad and see for yourself. More info here: http://forum.kaspersky.com/index.php?s=&am...t&p=2282289

Share this post


Link to post

To be precise, while hovering an image the script offers an option to add the URL to the block list. Previously an extension was used for that.

 

The actual filtering works the same way it did before, on traffic level.

Share this post


Link to post
Hi :) You can disable option "Auto activate plugin"

 

post-427714-1426159908_thumb.png

 

I deselected that option a year ago and the plug-ins are still active in Firefox.

It doesn't work. If you disable the plugins in FF, they re-enable themselves the next time you open FF.

The KIS extensions are disablible, but not the plugins.

If you want them disabled, I guess only way is to disabl and then never close firefox.

Share this post


Link to post

×
×
  • Create New...

Important Information

We use cookies to make your experience of our websites better. By using and further navigating this website you accept this. Detailed information about the use of cookies on this website is available by clicking on more information.