[[SOLVED] MBAE not allow me to open firefox or explorer]

BitDefender pushed out an update with a bug in their hooking mechanism.

 

We've pushed out a new build white-listing their buggy module. Please upgrade to the following build:

https://malwarebytes.box.com/s/ba1tybodsqr1c4jbbfuptrnejedg5h0x

[Getting MBARW to work after the error 'Unable to connect to service']

Can you check it the Service is running? Run "services.msc" and look for the MB3Services. Is it started or stopped? If stopped, try running it.

[False Positive - Adobe Update Utility]

Thanks for the report. Processing FP.

[FP's on Bvckup 2, SyncBackSE, Reason Core Security, Office Click-To-Run]

Thanks for the report. Processing FP now.

[Clean Master is detected as virus but it is actually not a virus]

Thanks for the report. Processing FP.

[False Positive OneDrive]

Thanks for the report. Processing FP.

[EPSON Event Manager False Positive]

Thanks for the report. Processing FP.

[Detecting CCleaner Pro as a false possative]

Thanks for the report. Processing FP.

[MBARW and Norton Security]

Thanks for the report. Processing FP.

[Glary Utilities marked a ransomware & rootkit]

Thanks for the report. Processing FP.

[[SOLVED] Multiple Exploit Blocks (potential BitDefender bug)]

Hi owman1, please read the following and install the build mentioned here:

https://forums.malwarebytes.org/index.php?/topic/177931-multiple-exploit-blocks-potential-bitdefender-bug/

[***URGENT*** MBAE*** Multiple alerts]

Manually upgrade one of the machines to this build to see if the problem persists:

https://malwarebytes.box.com/s/7ieqsyraismrn5kln37q0p5t4x6pcpy7

[[SOLVED] Multiple Exploit Blocks (potential BitDefender bug)]

Can you please try upgrading to this build to see if the problem persists?

https://malwarebytes.box.com/s/ba1tybodsqr1c4jbbfuptrnejedg5h0x

[***URGENT*** MBAE*** Multiple alerts]

No worries.

 

We're working on a hotfix build. Please stay tuned.

[Updating Malwarebytes Anti-Exploit]

Welcome to the forum.

 

Try rebooting and logging in with the administrator account.

[[SOLVED] Multiple Exploit Blocks (potential BitDefender bug)]

So it seems the culprit is "avcuf32.dll" from BitDefender. They probably pushed a buggy update and it is causing API hooking conflicts. Likely they'll have problems with other third-party applications that perform API hooking.

 

Can you please uninstall or completely disable BitDefender and reboot to see if the problem persists?

[***URGENT*** MBAE*** Multiple alerts]

The endpoint.

[***URGENT*** MBAE*** Multiple alerts]

Please provide MBAE and FRST logs. Instructions in my signature.

 

In the meantime you can deactivate these techniques:

 

Console -> Policy -> Anti-Exploit -> Advanced -> Hardening -> Deactivate Anti-HeapSpraying

Console -> Policy -> Anti-Exploit -> Advanced -> Hardening -> Deactivate BottomUp ASLR

[***URGENT*** MBAE*** Multiple alerts]

Do you have BitDefender installed by any chance?

 

It seems they updated their software recently and it causes a conflict.

[[SOLVED] Multiple Exploit Blocks (potential BitDefender bug)]

Thanks for the logs MDDI. We'll take a look and get back to you asap.

[[SOLVED] Error opening browser/apps on Windows 10]

Thanks for confirming guys!!

[MBARW Eats Eraser.exe]

Hi azarl. You should be able to add it to the exclusions. Can you please confirm?

[[SOLVED] Multiple Exploit Blocks (potential BitDefender bug)]

Thanks for the logs MDDI. This is an interesting case.

 

First of all I have to say you keep your computer pretty lean and clean. Congrats. Wish more people kept theirs this way.

 

Secondly, have you installed or upgraded any of your software lately? It's weird you had MBAE installed for quite some time but it only recently started alerting like this. My guess is that it's either some persistent exploit or a recent upgrade of some third-party software (BitDefender, Panda, ...) which is causing a conflict with MBAE.

 

I'll send you instructions via PM for further troubleshooting.

[[SOLVED] Multiple Exploit Blocks (potential BitDefender bug)]

Welcome to the forum.

 

Please post your MBAE and FRST logs. Instructions in my signature.

[IOBit Malware Fighter 4 Autoupdate.exe]

Here you go:

https://forums.malwarebytes.org/index.php?/topic/177810-how-to-report-a-false-positive/