locked
Fresh EMET 5.5 installation giving a ASR warning ( Module : VBScript.dll) running Explorer 11 RRS feed

  • Question

  • Hi,

    After the default installation of EMET 5.5, I just open explorer 11 and I get the following EMET warning, affecting the module VBScript.dll.

    could someone tell me why? how can I debug this warning to identify the reason?

    Many thanks.

    Jose

    EMET version 5.5.5871.31892
    EMET detected ASR mitigation in iexplore.exe

    ASR check failed:
      Application     : C:\Program Files\Internet Explorer\iexplore.exe
      User Name     : XXXXXXXX
      Session ID     : 1
      PID         : 0x16F0 (5872)
      TID         : 0x1444 (5188)
      Module     : VBScript.dll

    Monday, February 29, 2016 4:44 PM

All replies

  • I'm seeing the same thing on Windows 7 with IE11 and Windows Server 2012 R2.
    Tuesday, March 1, 2016 1:39 PM
  • Hi Jeff,

    according with this article, it seems like to be by design in 5.2... so I guess it is the same in 5.5.

    https://www.winhelp.us/microsoft-emet.html

    "EMET 5.2 added VBScript (vbscript.dll) blocking to IE in order to protect the browser from the so-called "VBScript God Mode" exploits."

    Wednesday, March 2, 2016 8:58 AM
  • Please have a look if disabling the Proxy auto-config [e.g. wpad] in IE11 helps to get rid of the message.

    Just set the proxy manually and test if ASR warning continues to show up.

    Wednesday, August 17, 2016 11:48 AM