Jump to content

Recommended Posts

Posted

It should work fine. I tried a similar configuration. Just to make it is not a security related issues. Can you reproduce this with all security software switched off (protected mode, UAC, firewall, defender, AV, AS and so on)? Usually this error is security related.

Cheers,

Kayhan

Dave,

Details are below:

OS Name Microsoft Windows XP Professional

Version 5.1.2600 Service Pack 3 Build 2600

OS Manufacturer Microsoft Corporation

System Manufacturer LENOVO

System Model 2623DDU

System Type X86-based PC

Processor x86 Family 6 Model 14 Stepping 8 GenuineIntel ~1995 Mhz

BIOS Version/Date LENOVO 79ETE1WW (2.21 ), 05.02.2008

SMBIOS Version 2.4

Standard Windows firewall is installed only. No any SpyWare etc. Everything worked before the update. May be this update turned on some options in IE or somewhere else - I don't know. If you advice I can try to play with IE or Firewall options (or what ever else) ...

Vadim

  • Replies 147
  • Created
  • Last Reply

Top Posters In This Topic

Top Posters In This Topic

Posted

Hello,

When you have a doubt on a file (virus, spyware...) downloaded or already on your computer, use a web site such as http://www.virustotal.com/ This site will test this file after you upload it with a lot of Antivirus and tell you if there is an issue. If only some of the Antivirus see an issue, this could be a false positive (or a new virus/spyware, or a better antivirus :P;- ) If the main part of virus see a problem, there should be a problem. You can choose the language of the site (Par exemple, les Français peuvent se connecter sur http://www.virustotal.com/fr/ ou sur http://www.virustotal.com/ et choisir Français ensuite). More information could be found in French at http://forum.malekal.com/viewtopic.php?f=59&t=9828

Other scanners seems to exist: VirScan : http://virscan.org/ VirusChief : http://www.viruschief.com/index.html Virus.Org : http://scanner.virus.org/

French people can read the http://www.malekal.com which is a very interested site on a large scale of subjects (see also forums).

If you have a more general doubt on files in your computer, use several (some will not work on your Operating System or Browser, some such as Panda will be seen themselves as virus by your own antivirus...) on-line scanners (search on google/yahoo...).

You can also (on another computer) create a UBCD4WIN (Universal Boot CD for Windows) bootable CD/DVD/USB Key (beware of the fact it will erase the media). See http://www.ubcd4win.com/ and for French people http://www.malekal.com/Scanner_CDLive_Ubcd4Win.php

Then, boot your computer on the CD/DVD/USB Key and are able to run a Windows XP, with a lot of tools (up-to-date due to the network support, Ethernet, Wifi...).

Rem: Keeform is build with AutoIt which is well known to raise false-positive alerts on Antivirus (as it can be used for dangerous things). Check on Google/Yahoo...

Best regards

FYI, the results today of the current version of KeeForm on www.virustotal.com: 4 Antivirus saw a problem or a potential problem but they are not the leaders of the Antivirus Market => I personally will trust KeeForm with those results.

File has already been analysed:

MD5: 29b79cd19492eb987ac680ee504af1f9

First received: 05.08.2008 22:06:03 (CET)

Date: 09.11.2008 14:18:39 (CET) [>26D]

Results: 4/36

Permalink: analisis/84c55784144bd94de955f7195a6f1836

File KeeForm107_12312007.zip received on 09.11.2008 14:14:34 (CET)

Current status: finished

Result: 4/36 (11.11%)

Compact Compact

Print results Print results

Antivirus Version Last Update Result

AhnLab-V3 2008.9.12.0 2008.09.11 -

AntiVir 7.8.1.28 2008.09.11 -

Authentium 5.1.0.4 2008.09.11 -

Avast 4.8.1195.0 2008.09.10 -

AVG 8.0.0.161 2008.09.11 -

BitDefender 7.2 2008.09.11 -

CAT-QuickHeal 9.50 2008.09.11 -

ClamAV 0.93.1 2008.09.11 -

DrWeb 4.44.0.09170 2008.09.11 -

eSafe 7.0.17.0 2008.09.10 Suspicious File

eTrust-Vet 31.6.6084 2008.09.11 -

Ewido 4.0 2008.09.11 -

F-Prot 4.4.4.56 2008.09.10 -

F-Secure 8.0.14332.0 2008.09.11 -

Fortinet 3.113.0.0 2008.09.11 -

GData 19 2008.09.11 -

Ikarus T3.1.1.34.0 2008.09.11 -

K7AntiVirus 7.10.450 2008.09.10 Trojan-Downloader.Win32.AutoIt.cg

Kaspersky 7.0.0.125 2008.09.11 -

McAfee 5381 2008.09.10 -

Microsoft 1.3903 2008.09.11 -

NOD32v2 3434 2008.09.11 -

Norman 5.80.02 2008.09.11 -

Panda 9.0.0.4 2008.09.10 -

PCTools 4.4.2.0 2008.09.10 -

Prevx1 V2 2008.09.11 -

Rising 20.61.32.00 2008.09.11 Worm.Win32.Agent.uh

Sophos 4.33.0 2008.09.11 -

Sunbelt 3.1.1624.1 2008.09.11 -

Symantec 10 2008.09.11 -

TheHacker 6.3.0.9.077 2008.09.10 Trojan/Downloader.AutoIt.co

TrendMicro 8.700.0.1004 2008.09.11 -

VBA32 3.12.8.5 2008.09.10 -

ViRobot 2008.9.11.1373 2008.09.11 -

VirusBuster 4.5.11.0 2008.09.10 -

Webwasher-Gateway 6.6.2 2008.09.11 -

Additional information

File size: 567109 bytes

MD5...: 29b79cd19492eb987ac680ee504af1f9

SHA1..: 90e815309d00564d3fa732ca6131b804aafa860b

SHA256: 4ca0030b4da11fe6f09b307beae88718a5a9ed5f3c1ffc02606620ab2493b342

SHA512: 112089bbba3c5cc740a6d70495ef548bcdcae978f2eee813462f504bd996b16d

0465f120151409acd0f6c4979b3c90847562abf138bf8a94a93d9f1e5116319e

PEiD..: -

TrID..: File type identification

ZIP compressed archive (100.0%)

PEInfo: -

packers (F-Prot): UPX

packers (Kaspersky): PE_Patch.UPX, UPX, PE_Patch.UPX, UPX

Posted

Hello,

When you have a doubt on a file (virus, spyware...) downloaded or already on your computer, use a web site such as http://www.virustotal.com/ This site will test this file after you upload it with a lot of Antivirus and tell you if there is an issue. If only some of the Antivirus see an issue, this could be a false positive (or a new virus/spyware, or a better antivirus :P;- ) If the main part of virus see a problem, there should be a problem. You can choose the language of the site (Par exemple, les Français peuvent se connecter sur http://www.virustotal.com/fr/ ou sur http://www.virustotal.com/ et choisir Français ensuite). More information could be found in French at http://forum.malekal.com/viewtopic.php?f=59&t=9828

Other scanners seems to exist: VirScan : http://virscan.org/ VirusChief : http://www.viruschief.com/index.html Virus.Org : http://scanner.virus.org/

French people can read the http://www.malekal.com which is a very interested site on a large scale of subjects (see also forums).

If you have a more general doubt on files in your computer, use several (some will not work on your Operating System or Browser, some such as Panda will be seen themselves as virus by your own antivirus...) on-line scanners (search on google/yahoo...).

You can also (on another computer) create a UBCD4WIN (Universal Boot CD for Windows) bootable CD/DVD/USB Key (beware of the fact it will erase the media). See http://www.ubcd4win.com/ and for French people http://www.malekal.com/Scanner_CDLive_Ubcd4Win.php

Then, boot your computer on the CD/DVD/USB Key and are able to run a Windows XP, with a lot of tools (up-to-date due to the network support, Ethernet, Wifi...).

Rem: Keeform is build with AutoIt which is well known to raise false-positive alerts on Antivirus (as it can be used for dangerous things). Check on Google/Yahoo...

Best regards

FYI, the results today of the current version of KeeForm on www.virustotal.com: 4 Antivirus saw a problem or a potential problem but they are not the leaders of the Antivirus Market => I personally will trust KeeForm with those results.

File has already been analysed:

MD5: 29b79cd19492eb987ac680ee504af1f9

First received: 05.08.2008 22:06:03 (CET)

Date: 09.11.2008 14:18:39 (CET) [>26D]

Results: 4/36

Permalink: analisis/84c55784144bd94de955f7195a6f1836

File KeeForm107_12312007.zip received on 09.11.2008 14:14:34 (CET)

Current status: finished

Result: 4/36 (11.11%)

Compact Compact

Print results Print results

Antivirus Version Last Update Result

AhnLab-V3 2008.9.12.0 2008.09.11 -

AntiVir 7.8.1.28 2008.09.11 -

Authentium 5.1.0.4 2008.09.11 -

Avast 4.8.1195.0 2008.09.10 -

AVG 8.0.0.161 2008.09.11 -

BitDefender 7.2 2008.09.11 -

CAT-QuickHeal 9.50 2008.09.11 -

ClamAV 0.93.1 2008.09.11 -

DrWeb 4.44.0.09170 2008.09.11 -

eSafe 7.0.17.0 2008.09.10 Suspicious File

eTrust-Vet 31.6.6084 2008.09.11 -

Ewido 4.0 2008.09.11 -

F-Prot 4.4.4.56 2008.09.10 -

F-Secure 8.0.14332.0 2008.09.11 -

Fortinet 3.113.0.0 2008.09.11 -

GData 19 2008.09.11 -

Ikarus T3.1.1.34.0 2008.09.11 -

K7AntiVirus 7.10.450 2008.09.10 Trojan-Downloader.Win32.AutoIt.cg

Kaspersky 7.0.0.125 2008.09.11 -

McAfee 5381 2008.09.10 -

Microsoft 1.3903 2008.09.11 -

NOD32v2 3434 2008.09.11 -

Norman 5.80.02 2008.09.11 -

Panda 9.0.0.4 2008.09.10 -

PCTools 4.4.2.0 2008.09.10 -

Prevx1 V2 2008.09.11 -

Rising 20.61.32.00 2008.09.11 Worm.Win32.Agent.uh

Sophos 4.33.0 2008.09.11 -

Sunbelt 3.1.1624.1 2008.09.11 -

Symantec 10 2008.09.11 -

TheHacker 6.3.0.9.077 2008.09.10 Trojan/Downloader.AutoIt.co

TrendMicro 8.700.0.1004 2008.09.11 -

VBA32 3.12.8.5 2008.09.10 -

ViRobot 2008.9.11.1373 2008.09.11 -

VirusBuster 4.5.11.0 2008.09.10 -

Webwasher-Gateway 6.6.2 2008.09.11 -

Additional information

File size: 567109 bytes

MD5...: 29b79cd19492eb987ac680ee504af1f9

SHA1..: 90e815309d00564d3fa732ca6131b804aafa860b

SHA256: 4ca0030b4da11fe6f09b307beae88718a5a9ed5f3c1ffc02606620ab2493b342

SHA512: 112089bbba3c5cc740a6d70495ef548bcdcae978f2eee813462f504bd996b16d

0465f120151409acd0f6c4979b3c90847562abf138bf8a94a93d9f1e5116319e

PEiD..: -

TrID..: File type identification

ZIP compressed archive (100.0%)

PEInfo: -

packers (F-Prot): UPX

packers (Kaspersky): PE_Patch.UPX, UPX, PE_Patch.UPX, UPX

Posted

Hi all,

if you do not trust the two precompiled programs KeeForm/KeeRun.exe (after all it is about your secret passwords :-), then you could build these executables yourself.

It is relatively easy. Just follow the following steps in order to compile the two executables KeeForm.exe and KeeRun.exe with AutoIt:

- Download and install AutoIt v3 first (freeware)

- Copy the files KeeForm.au3 and KeeRun.au3 into the KeePass directory.

- Compile the scripts by right clicking on each au3 file and selecting "compile script". This should result in two new executables KeeRun.exe and KeeForm.exe

Takes less than two minutes.

Cheers, Dave

  • 4 weeks later...
Posted

Hi all,

i am a new user on this forum, using keepass since many years.

i have 2 pc (xp sp3, and IE7 on both) where is installed the same copy of keepass 1.14 and keeform 1.07.

on the first pc, all works fine but on the second i have this trouble :

"when I double-click a URL entry to initiate login, one instance of IE (explorer in fact) will open, but it remains blank with no entry it the address field. Then a few seconds later another instance opens and shows the login page, but the user name and password are never entered. Also, an error message appears saying IE Error # 80020009 Unspecified error."

i have recompiled keeform.au3 adding inside, a line for analysing the problem.

; Open Internet Explorer
    _KeeDebugPrint ("ObjCreate(InternetExplorer.Application)", $_KeeDebugLevelInfo)
    $oIE = ObjCreate("InternetExplorer.Application")
    _KeeDebugPrint ("ObjName ($oObject) = " & ObjName ($oIE), $_KeeDebugLevelErr)
MsgBox (1,"ThereIsABug", ObjName ($oIE) & @CRLF & $oIE.locationname & @CRLF & $oIE.fullname ,10)  <== the line i have add at this place

The result is :

on the pc who works fine InternetExplorer.Application is IWebBrowser2 who is associated to c:\program files\internet explorer\iexplore.exe

on the pc having the bug InternetExplorer.Application is IWebBrowser2 who is associated to c:\windows\explorer.exe

the strange thing is that the two pcs have the same values in the registry for internetexplorer.application,

[HKEY_CLASSES_ROOT\InternetExplorer.Application]
@="Internet Explorer"

[HKEY_CLASSES_ROOT\InternetExplorer.Application\CLSID]
@="{0002DF01-0000-0000-C000-000000000046}"

[HKEY_CLASSES_ROOT\InternetExplorer.Application\CurVer]
@="InternetExplorer.Application.1"

[HKEY_CLASSES_ROOT\InternetExplorer.Application.1]
@="Internet Explorer (Ver 1.0)"

[HKEY_CLASSES_ROOT\InternetExplorer.Application.1\CLSID]
@="{0002DF01-0000-0000-C000-000000000046}"

[HKEY_CLASSES_ROOT\CLSID\{0002DF01-0000-0000-C000-000000000046}]
@="Internet Explorer(Ver 1.0)"
"AppID"="{0002DF01-0000-0000-C000-000000000046}"

[HKEY_CLASSES_ROOT\CLSID\{0002DF01-0000-0000-C000-000000000046}\LocalServer32]
@="\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""

[HKEY_CLASSES_ROOT\CLSID\{0002DF01-0000-0000-C000-000000000046}\ProgID]
@="InternetExplorer.Application.1"

[HKEY_CLASSES_ROOT\CLSID\{0002DF01-0000-0000-C000-000000000046}\Programmable]
@=""

[HKEY_CLASSES_ROOT\CLSID\{0002DF01-0000-0000-C000-000000000046}\TypeLib]
@="{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}"

[HKEY_CLASSES_ROOT\CLSID\{0002DF01-0000-0000-C000-000000000046}\VersionIndependentProgID]
@="InternetExplorer.Application"

Does anyone know where i can correct this in the registry ? i've found nothing on the web

Sincerely yours, Themis

Posted

Themis,

please share some more information. Do you run XP and Vista on your two PCs?

Cheers,

Dave

Hi Dave,

i have XP SP3 and IE7 on the two PCs

Posted

The problem is most likely caused by some security software. Is there a difference between the two PCs? It could be a firewall, anti-spyware or AV software that blocks somehow the communication between KeeForm and IE. Try to disable any security software temporarily. This problem usually occurs on Vista because of the new UAC and IE protected mode.

Cheers,

Dave

Posted

Hi,

i've uninstall my firewall and my antivirus ( it was the time to update them :mellow: ), the problem still continue.

thanks for your interest to my problem

Themis

Posted

Yes Mmavipc, We know Keepass, i use it with keeform :-)

Dave i've not installed any other browser. and have reinstalled the same applications on the two pcs.

i don't understand why OLE internetexplorer.application launch iexplore.exe on a pc and explorer.exe on the other ://

Posted

Themis,

there must be a difference in configuration between the two PCs (usually it is some kind of security setting).

Please send me also the debug log that you can create as describe here:

#525482

Cheers,

Dave

Posted

Hello:

This message is for users of KeePass and KeeForm on Windows Vista.

You can run KeeForm in KeePass on Vista just fine with Vistas UAC (User Account Control) and IE 7 Protected mode turned ON (preferred). You also do not have to run KeePass as an administrator (preferred).

Here is how:

Step 1. Open Windows Explorer or My Computer and navigate to the KeePass folder (usually "C:\Program Files\KeePass Password Safe").

Step 2. Right click on KeeForm.exe and choose Properties.

Step 3. Click on the Compatibility tab.

Step 4. Check the box Run this program as an administrator.

Step 5. Click Ok and close Windows Explorer / My Computer.

Now, when you double click on a URL in KeePass, KeeForm will automatically start as an administrator and thus will automatically launch IE 7 with protected mode turned off for this one instance to allow KeeForm to function.

Kudos to Dave for creating an awesome plugin for KeePass!

- Justin

  • 2 weeks later...
Posted

Any chance of developing Keepass, Keeform and Keerun for the Firefox browser which is gaining in popularity and importance.

I was hoping to use it fully on my Firefox browser but now it seems that I may have to buy the one which I am using now "Password Manager XP".

:mellow::(

Posted

KeePass and KeeRun are browser independent. I guess you are asking for a Firefox plugin (like Roboform or so). I would port KeeForm to Firefox, but unfortunately Firefox doesn't have any DOM/APIs that could be used to port the 100 lines that integrate with Internet Explorer. At least I don't know how :-)

Cheers,

Dave

  • 1 month later...
Posted

Just FYI

KeePass 1.14 has been released: http://keepass.info/news/n081018_1.14.html

It looks like that KeeForm 1.07 is compatible with KeePass 1.14. But if there are any issues, please let me know.

Cheers, Dave

Dave, this is a great little KeePass add-on that really makes things much simpler. Unfortunately, I can't get it to work on the 2.06 Beta version (XP or Windows). I followed the Quick Installation Guide for KeePass 2.0 steps in the readme107.htm file. Do you have any suggestions? Is there a planned update for Beta now that it is more stable?

-- Chris

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...