TeamHorner

Have a user that when they attempt to open a PDF attachment from an outside vendor or try to forward the message they are getting a Malwarebytes blocked message for Outboundconnection (255.255.255.255:68) I have done a scan on the system and there are no infections. They have no browsers open, the e-mail is just plain text, yet they get the message.

The reboot of the balance on the systems put the Anti-Exploit into a shields on status.

Going into the services.msc and stopping the MalwareBytes Anti-Exploit service, mbae-svc.exe and then restarting it didn't change the behavior in the Management Console. After I rebooted the system, the Anti-Exploit Shields are now showing as enabled in the Management Console. I thought I had done a reboot prior to posting, but with all the systems that I'm deploying to, some may have been missed. I will try this on the others that are showing the shields off in the management console after hours tonight and report back if that solves it for the balance of the systems.

Here are the logs from one of the systems that is showing the shields off. MBMC_Client_Diagnosis_Info_2017_07_26_182627.zip

I'm in the process of deploying MBAM and MBAE and have the Malwarebytes Management Console version 1.8.0.3443. All endpoints are being deployed the same way by removing the Free Endpoint uninstaller, then the system is rebooted, and after it is rebooted the software is deployed. On several of the endpoints I am getting a gray shield in the Management Console showing that shields are off. Yet when I go to the endpoint it is showing MBAE is running and when I click on the Shields tab on the endpoing in MBAE it appears that the shields are running as I have the ability to click the Deactivate button. How can I get these endpoints to have their shields on?