[Outlook attachments causing "Exploit payload from UNC blocked"]

Hello Pcperson,

 

Can you please collect these logs for me, I want to confirm what the alert is in the log:

 

 

[Unable to to add program to Exclusion List]

Hello RJM4484,

 

I cam move the thread for you. I will be reaching out to you for more information in a PM based on what I am seeing in the log as well. 

[MBAE service taking too long to start]

Hello Colin,

 

To activate the product, open up the program and click on the 'activate' button on the bottom of the interface. You should be able to activate it with your ID and Key at that point. 

[MBAE service taking too long to start]

Hello Everyone,

 

We have a test build we want to see works for everyone that is having this issue. This build can be found here:

 

https://malwarebytes.box.com/s/n6cdj8wss05jlepevauf5lwowlq2g9bg

 

If possible, please do an un-install of the previous one and use this clean tool after to cleanup any leftover files: https://forums.malwarebytes.org/applications/core/interface/file/attachment.php?id=199258 (note: this will be the same one I left before for anyone trying the steps earlier in the thread). After you do that, reboot and try that build. Please let me know of any feedback on the build! 

[MBMC]

Hello Preyash,

 

It seems like the service stopped after this event:

Info    2016-11-11 14:01:58.1803    1764    7    Sent client status successfully.

After that, it does not communicate. Can you grab the event viewer logs from that time and see if there is any errors with the services? Also, would you have possibly had any updates or policies being pushed out that may have occurred at that time? We may need to collect further diagnostic logs from the computer. These logs do have information about the computer that you may not want on the forums (signed in users) so if you want, please send them to me via PM.

1: Please download FRST from the link below and save it to your desktop:

http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/

2: Double-click the purple FRST icon to run the program. Click Yes when the disclaimer appears.

3: Click the Scan button

4: When the scan has finished, it will make 2 log files in the same directory the tool is run, FRST.txt and Addition.txt. Please attach both files in your reply.
 

 

[Unable to open malwarebytes website]

Hello Tariq,

What website are you referring to in this example? Also, what browser are you using to try and go to that website? 

I want to understand the issue a bit first before I recommend a next action for you. 

 

 

[Outlook attachments causing "Exploit payload from UNC blocked"]

Hello CMGeorge,

 

I am going to send you a PM with some instructions for extra diagnostic logs that I want. 

[MBMC]

Hello Preyash,

 

Can you try running that tool as administrator and see if you get the same message? I want to see the logs for the other issue, but I think running that as admin should fix the issue with collecting the logs. 

[MBAE / Forcepoint DLP Endpoint Agent causing false positives]

Hello All,

 

Can you you please collect the logs found here:

 

Thank you,

[MBAE production version 1.09.1.1261 will not run on pre-SSE2 processor but MBAE beta(?) 1.09.1.1254 can]

Hello Hake,

Just as a test, can you try to do a clean re-install to that 1261 (not an upgrade) and see if it fixes it? I just want to test something that was reported to me. If that does not fix it still, try this new build 1264 and see if it fixes it:

https://malwarebytes.box.com/s/83akrg3qny018gnjs20txz242148hy67

[Adding additional license files to Management Console]

Hello Keyways,

 

I am going to be sending you a PM since I will need the information on the licenses to assist further. 

[Unable to to add program to Exclusion List]

Hello RJM4484,

 

Can you collect the logs noted in this post:

 

 

I want to see exactly what the logs are showing the alert as to see if it can be excluded. 

[Scan IP Range]

Hello Sixpack,

 

Usually that no logon servers message is an issue with dns resolving the authentication to that computer. As for the other issue, I want to send you an PM with some information. 

[Windows 10 Issue with Premium]

I always seem to do that. Sorry about that. I fixed it so now anyone who looks for it in the future should also be able to click on it. 

[McaFee conflict]

Hello Toadstew2016,

 

Usually if there is a conflict with another program, you will see either alerts or crashing on programs that we would both be protecting. Are you seeing something you think is a conflict with McAfee? 

[Anti Exploit not working on Windows 10]

Hello rlee_la,

 

Can you try using this tool to clean up the files for the installation:

 

That is our clean tool and it will clean all the directories our program is installed in. Once you run that, reboot the computer and try installing the latest version from this link:

 

https://downloads.malwarebytes.org/file/mbae

[Windows 10 Issue with Premium]

Hello Riadershog,

 

Can you try un-installing the program again and then using the clean tool found here to make sure all the associated files are completely removed?

 

Once you do that, reboot the computer and do a re-install with the link you used before. After you install it should ask you to activate again. Activate and see if you still have that issue. 

[Experimental Build 1.09.1.1254]

Hello Cliffs,

 

That is good to hear! Thank you for the feedback on this. 

[Anti-Exploit Temp Fixed Failed]

Hello ShoNuff,

 

You are referring to the ROP gadget detection that you posted in here about correct?

 If you are, can you go into anti-exploit>settings tab>advanced settings button> advanced memory detection. From there, can you see if the ROP gadget detection for browsers and the malicious return address detection for browsers are still enabled? 

[MBAE causing startup delays]

Hello Xirw,

 

Can you describe the startup delays that you are seeing? Are you referring to the starting up of the computer or the starting up to the programs? Also, have you tried un-installing or disabling the protection to confirm it is our program causing this on the machine? 

[Scan IP Range]

Hello SixPack,

 

Just to confirm, nothing is in that drop down and nothing shows in the window much like in my screenshot correct? If that is not the case can you get me a screenshot just for my purposes? You can send it in a PM if you need to.

 

Also, you may want to go to the admin>other settings tab and re-add the domain query account or test another account and see if they show up. If they do not, let me know. 

[MBMC]

Hello Preyash,

 

I am going to send you a PM with a file that will help this issue. The sql account may have been swapped to another use and I am giving you a .bat file to help. 

[Anti Exploit]

Hello Sricpa,

As a test, can you please go to this forum and download the test tool to see if the protection is working:

 

Also, do you know what the threat was that Norton blocked? It may have not been an exploit based attack which would be why anti-exploit wouldn't have blocked it. 

[Any plans to support open/free databases?]

Hello,

 

From what I know, the next version of the product does not have this feature so I am not sure what the current plans for that ultimately is. What I can do, however, is submit this to our team as a feature request. It doesn't solve the problem instantly for you unfortunately but it is something that they can consider in a new build of the program. 

[Missing clients]

Hello Hai,

 

The second client may need you to remove the client and do the re-install over the top if what is said in the message doesn't work. The first message is not always a bad message. It just means that during the registration period, the client couldn't connect. Can you check in the client pane if the client shows up there as online? If it does not, we may need to look into that further to see why it is not connecting.