Firewall blocking flashplayerplugin with Memory Modified

Hi

Please help flashplayer 18 has just stopped working, Firewall log reports:-

   flashplayerplugin_18_0_0_203.exe    OUT REFUSED     TCP    217.32.25.231    HTTPS    Memory Modified

I have see that this has happened before but there was no solution shown

I am currently running an indepth scan just to make sure that its not infected by a virus.

Windows 7 SP 1 plus loads of updates!

Sophos Endpoint 10.3

Thanks

Hello theboy,

no solution shown

perhaps because there wasn't a permanent problem in the first place?

has just stopped working

after a process has been blocked it must be restarted so that it's again allowed to access the network. For a plugin a browser restart should do it. So - is it again blocked after a restart (and for all Flash content or only specific sites)? If so, what has changed before it just stopped? Did you update to the latest (203), or ...?

BTW: Do you recognize the address (217.32.25.231) it's attempting to connect to? Seems to be from a pool owned by BT, maybe it's dynamically assigned.

Christian

Hello Christian

Thank you replying

Restarted the browser (Firefox) several times- just download IE version 11 seems to working fine in IE! I reinstalled flash player and it works once then is blocked, but as far as I can tell it is only on BBC news site.

Can’’’’t see what changed because will its working it does not appear in the firewall log.

Version is Firefox, Mozilla - NPAPI      18.0.0.203.

However I now find that it happened in the earlier version – sorry I did not know that it auto updated so I assumed it was happening with the latest version.

06/07/2015 09:22:53 flashplayerplugin_18_0_0_194.exe   OUT REFUSED     TCP     95.140.227.18    1935     Memory Modified

IP 217.32.25.231 like you say is a pool owned by BT

Hello theboy,

this one is to the Flash RTMP port on a Limelight CDN host. Can't say what causes the plugin's memory to be modified but apparently it is "something" on the site (or page) you are accessing and only when you're using Firefox. I don't say that there's something malicious on the site (but also won't rule it out). Anyway I'd not try to circumvent the blocking before I know what's going on.

Any add-ons in Firefox? 

Christian   

HI

yes some 

Extensions

Adblock Plus 2.6.9.1 signed

Youtube video downloader as MP4 1.8.3.1-signed

Plugins

Cisco openh264 1.4

Adobe Primetime HTML5 Content Decryption Module 11

Shockwave-flash 18.0.0.203

Adobe Acrobat 15.7.20033.2203

Photo Galley 16.4.3528.331 NPWLPG.dll no idea what this is so I deactivated it

Hello theboy,

dunno how SCF detects the Memory modified (and this feature is getting phased out). Now the Adobe Primetime CDM came with Firefox 38.0 and maybe, just maybe, this interacts with the Flash plugin.

Christian

Hi Christian

Thanks for help, not sure were I go from here . However this morning I received this message when using Firefox

"Flash Player Plugin 18.0.0.203 (click-to-play) has been blocked for your protection."

So the memory modification looks like a problem.

Hello theboy,

this time it's Firefox that has blocked the plugin, SCF is not involved. Go to Tools->Add-ons, click More information ... for the plugin or see Mozilla's plugins-check page.

Christian

HI

I know this time its Firefox - so I upgraded to the new addon and flash player worked hurrah! - for one session and then it was blocked with a memory modified message.