7 replies to this topic

[Pinballman]

Hi

 

Tables were working fine until this afternoon - now when I start many of them I get a script error "This script contains malicious content and has been blocked by your antivirus software: 'ExecuteGlobal'

 

I don't understand what caused this, never had a problem before. If I turn off Window antivirus everything works. Tried excluding VP, Pinup player execs, folders, etc, nothing helps  Am on Windows 10.  Any help very much appreciated!!!!

[Bushav]

Same thing happened to me today. Go into settings then virus protection. Turn off “real time protection “. However Windows will turn it back on in a few hours. So, Google how to turn it off permanently. You will find a video that shows you how to create a registry entry that turn it off permanently. Don’t download any of the apps that promise to do it. Just create the required registry entry.

[Pinballman]

Same thing happened to me today. Go into settings then virus protection. Turn off “real time protection “. However Windows will turn it back on in a few hours. So, Google how to turn it off permanently. You will find a video that shows you how to create a registry entry that turn it off permanently. Don’t download any of the apps that promise to do it. Just create the required registry entry.

Thank you for your response. By turning off real time protection won't that leave my pc open to viruses?

[wiesshund]

Hi

 

Tables were working fine until this afternoon - now when I start many of them I get a script error "This script contains malicious content and has been blocked by your antivirus software: 'ExecuteGlobal'

 

I don't understand what caused this, never had a problem before. If I turn off Window antivirus everything works. Tried excluding VP, Pinup player execs, folders, etc, nothing helps  Am on Windows 10.  Any help very much appreciated!!!!

 

If your PC is online and used for things besides VPX, i suggest do NOT disable your AV

 

take the below and copy it

edit it in notepad to reflect YOUR paths
and if you dont use future pinball, you can delete those lines entirely

Add-MpPreference -ExclusionProcess "c:\emulation\VPX\VPinballX.exe"
Add-MpPreference -ExclusionProcess "c:\emulation\VPX\VPinball 10.7.4360.exe"
Add-MpPreference -ExclusionProcess "c:\emulation\FP\BAM\Fploader.exe"
Add-MpPreference -ExclusionProcess "c:\emulation\FP\Future Pinball.exe"
Add-MpPreference -ExclusionPath "c:\emulation\VPX\Tables\*.vbs"
Add-MpPreference -ExclusionPath "c:\emulation\VPX\Scripts\*.vbs"
Add-MpPreference -ExclusionPath "c:\emulation\FP\Scripts\*.vbs"
Add-MpPreference -ExclusionPath "c:\emulation\VPX\VPinballX.exe"
Add-MpPreference -ExclusionPath "c:\emulation\VPX\VPinball 10.7.4360.exe"
Add-MpPreference -ExclusionPath "c:\emulation\FP\Future Pinball.exe"
Add-MpPreference -ExclusionPath "c:\emulation\FP\BAM\Fploader.exe"

Now once you have edited it as appropriate

open an ADMIN powershell window

and paste your edited lines into it

might have to hit enter

 

Now you should not have issues
Just dont take any tables from unknown unproven sources
and VPX does use VBS script, and a malicious asshole could technically do some bad stuff through it
which is why your AV is taking offense.

The above will basically tell it to leave VPX and its use of VBS alone

And again, only accept tables and vpx software from official or reliable sources

And yes, you have to do the exceptions in the manner i am showing you above
or it wont exception VPX enough

 

You dont generally need to exception PUP i dont believe

[clyde]

Thanks wiess, I also had the same problem today with NUMEROUS tables getting that same error. I did what you posted above & all seems good now. 

[wiesshund]

Thanks wiess, I also had the same problem today with NUMEROUS tables getting that same error. I did what you posted above & all seems good now. 

I get the same thing, if i launch vpx 10.6.exe
Is just antivirus doing as it is designed to do, and i dont have that exe exceptioned

 

If you use VP9, just make sure to exception your VP9 exe the same way as i showed vpx
and if you keep your vp9 tables in a separate folder, make sure to do a *.vbs exception for that folder path, in case you use any external table scripts

 

Personally, i dont use external table scripts.
If i get one of thalamus's updated scripts for a table, i will run it once as an external script to make sure it is what i want, and then if it is
i open it in notepad++, and then delete the file itself, and copy it from notepad++
then i open the table again, in the editor, and i replace the stock script, and i usually update the table info to reflect what script i updated the table to.

That way, i only have the vbs files that come with vpx

It isnt free to have a program listed for specific exceptions, and due to the nature of how VPX works, MS possibly may not do it anyways
from their side, the risk is too great, putting them at fault, and they have taken a lot of heat over the years for being too lax in those areas.

So instead, they give ways for a person who knows enough to set up their own in depth exceptions.

The reason it did not work when you did a normal exception is because you need 2 kinds of exceptions for VPX itself

1) you have to exclude the process, which tells it that it does not need to poke its fingers into VPX when it is running
This helps defender not kill the table as the vb script is all internal in that regard

 

2) you exclude the exe itself as a path, which looks funny in writing, but that that does is let AV basically know to ignore checking it for loading an external file
in this case, the VBS files that it calls with the execute external.
Otherwise what happens is defender lets it run the table script, up to the point that it calls up an additional external VBS.
Otherwise it will shut it down as technically that is a security risk.

It is VBS so basically, one could code it to do literally anything, erase files, email files, log keys, invite someone to remote in, or even serve to simply go and download
something much nastier and install it.

 

Which is why i say, DO NOT get tables, no matter how tempting, from any site that is not reputable
VPForums, VPUniverse and a few of the other sites that have been around a long time.
If in doubt, ask someone here like thalamus or outthere etc.

 

3) You exception the tables and scripts path's with *.vbs in the path.
This is so defender knows not to go about blocking or deleting your script files themselves
The scripts contain actions that can and will flag them as dangerous
For example some tables will create and write to a file, like how EM tables save high scores in a text file
Or like controller or bs2, they call up DLL's
And things like that, this this tells defender to leave them alone, which is why you dont want joe blow's random pinball scripts

 

vpforums and vpu have people that look at every upload for maliciously made crap
I am sure the other good sites do as well, i just can not attest to it as i dont really use them, i mostly get tables from here, and once in a while VPU

 

The thing with VB Script is, it is plain text, you can not hide anything in it, but most people are not really capable of reading it and knowing if they just saw something malicious or not
hence AV being so protective

[Pinballman]

 

Hi

 

Tables were working fine until this afternoon - now when I start many of them I get a script error "This script contains malicious content and has been blocked by your antivirus software: 'ExecuteGlobal'

 

I don't understand what caused this, never had a problem before. If I turn off Window antivirus everything works. Tried excluding VP, Pinup player execs, folders, etc, nothing helps  Am on Windows 10.  Any help very much appreciated!!!!

 

If your PC is online and used for things besides VPX, i suggest do NOT disable your AV

 

take the below and copy it

edit it in notepad to reflect YOUR paths
and if you dont use future pinball, you can delete those lines entirely

Add-MpPreference -ExclusionProcess "c:\emulation\VPX\VPinballX.exe"
Add-MpPreference -ExclusionProcess "c:\emulation\VPX\VPinball 10.7.4360.exe"
Add-MpPreference -ExclusionProcess "c:\emulation\FP\BAM\Fploader.exe"
Add-MpPreference -ExclusionProcess "c:\emulation\FP\Future Pinball.exe"
Add-MpPreference -ExclusionPath "c:\emulation\VPX\Tables\*.vbs"
Add-MpPreference -ExclusionPath "c:\emulation\VPX\Scripts\*.vbs"
Add-MpPreference -ExclusionPath "c:\emulation\FP\Scripts\*.vbs"
Add-MpPreference -ExclusionPath "c:\emulation\VPX\VPinballX.exe"
Add-MpPreference -ExclusionPath "c:\emulation\VPX\VPinball 10.7.4360.exe"
Add-MpPreference -ExclusionPath "c:\emulation\FP\Future Pinball.exe"
Add-MpPreference -ExclusionPath "c:\emulation\FP\BAM\Fploader.exe"

Now once you have edited it as appropriate

open an ADMIN powershell window

and paste your edited lines into it

might have to hit enter

 

Now you should not have issues
Just dont take any tables from unknown unproven sources
and VPX does use VBS script, and a malicious asshole could technically do some bad stuff through it
which is why your AV is taking offense.

The above will basically tell it to leave VPX and its use of VBS alone

And again, only accept tables and vpx software from official or reliable sources

And yes, you have to do the exceptions in the manner i am showing you above
or it wont exception VPX enough

 

You dont generally need to exception PUP i dont believe

 

That did it!  Thank you SO much!!!  

I only download tables from this site or Virtual Pinball. Yesterday I downloaded one thing, a pup pack from Virtual Pinball for Stern Star Trek LE, and found it strange that when I went into the editor it said access denied. Anti virus problem started a few hours later.  Do you think I should delete the pup pack?

Edited by Pinballman, 08 August 2021 - 03:56 AM.

[wiesshund]

 

 

That did it!  Thank you SO much!!!  

I only download tables from this site or Virtual Pinball. Yesterday I downloaded one thing, a pup pack from Virtual Pinball for Stern Star Trek LE, and found it strange that when I went into the editor it said access denied. Anti virus problem started a few hours later.  Do you think I should delete the pup pack?

 

 

AV issue was due to an update