[SOLVED] My MBAE stopped working and it will not load

[Firefox]

My MBAE stopped working and it will not load. This is the same computer I was having an issue with MBAE before HERE

 

I have attached the log below.... I actually have had the issue for a bit longer, I just did not have time to play with it here.....

 

 

[pbust]

Out of curiosity, what other security software do you have installed on that PC? Might be interesting to know what else was installed or changed at the time it stopped working.

 

Also try exiting MBAE from the traybar icon, uninstalling from Control Panel, and installing fresh. Does it run OK then?

 

Also could you check that you don't have an older install of ExploitShield on that machine that is also trying to run at the same time?

[Firefox]

Security software on this computer is Symantec Endpoint Protection version 12.1.100.157 RU1 together with MBAM latest version. The only thing that changed was installing the new version of MBAE (it works with an older version)

I can not exit MBAE from the traybar icon as it is not running cause it will not start without the error. I verified it was not running by checking Task Manager and showing all processes from all users. I uninstalled MBAE from Control Panel. Deleted a Scheduled Task I found in pointing to C:\Program Files\Malwarebytes Anti-Exploit\mbaeloader64.exe "C:\Program Files\Malwarebytes Anti-Exploit\mbae64.exe" (I believe this is from an older version and I had not looked there before) I then Deleted the folder in C:\Program Files and I then deleted the reg keys below:

HKLM\Software\Malwarebytes Anti-Exploit (deleted)

HKLM\System\controlSet001\Enum\Root\Legacy_ESProtectionDriver\0000 (but I could not delete or change permissions to delete)

HKLM\System\controlSet001\services\ESProtectionDriver (deleted)

HKLM\System\controlSet002\Enum\Root\Legacy_ESProtectionDriver\0000 (but I could not delete or change permissions to delete)

HKLM\System\controlSet002\services\ESProtectionDriver (deleted)

HKLM\System\CurrentconntrolSet\Enum\Root\Legacy_ESProtectionDriver\0000 (but I could not delete or change permissions to delete)

Rebooted the computer

Downloaded New Beta v0.9.2.1400 and installed and I get an error: Cannot start Malwarebytes Anti-Exploit Driver, the Malwarebytes Anti-Exploit process will be terminated. I also get a desktop icon that is pointing to "C:\Program Files\Malwarebytes Anti-Exploit\mbae64.exe" that does not exist. I can rename the executable to mbae.exe and the icon shows up correctly but running the file gives me the same error.

Do you think it has anything to do with the fact that this version does not have the file mbae64.exe? Can you PM me the build prior to this one so I can test to see if it works with that build (I seemed to have deleted that build)

Mbae-default.log

2013-07-18 08:28:06 - The Malwarebytes Anti-Exploit task scheduler has been successfully created

2013-07-18 08:28:06 - Malwarebytes Anti-Exploit Driver is already Installed

2013-07-18 08:28:06 - System Error Code: 2 - Can not start Malwarebytes Anti-Exploit Driver

2013-07-18 08:28:13 - Cannot start Malwarebytes Anti-Exploit Driver, the Malwarebytes Anti-Exploit process will be terminated

2013-07-18 08:31:45 - The Malwarebytes Anti-Exploit task scheduler has been successfully created

2013-07-18 08:31:45 - Malwarebytes Anti-Exploit Driver is already Installed

2013-07-18 08:31:45 - System Error Code: 2 - Can not start Malwarebytes Anti-Exploit Driver

2013-07-18 08:31:48 - Cannot start Malwarebytes Anti-Exploit Driver, the Malwarebytes Anti-Exploit process will be terminated

[pbust]

I'll PM previous version so you can try with that. Make sure to completely uninstall the current version from Control Panel and then reboot before installing the older version. Ditto for when you try upgrading to the newer version again.

[Firefox]

OK I got the previous version downloaded.

 

1. uninstalled version 0.9.2.1400 

2. Rebooted

3. Deleted folder in Program Files

4. installed version 0.9.2.1200

 

Finished the install and all working fine.

 

Things that I noticed....

1. Shortcut points to "C:\Program Files\Malwarebytes Anti-Exploit\mbae64.exe"

2. No Google toolbar issue like I had when I typed something in the search box

 

Here is the log file...

2013-07-18 11:57:54 - The Malwarebytes Anti-Exploit task scheduler has been successfully created
2013-07-18 11:57:56 - Malwarebytes Anti-Exploit Driver Installed successfuly
2013-07-18 11:57:56 - Malwarebytes Anti-Exploit Driver is running
2013-07-18 11:57:56 - Starting Injection with: C:\Program Files\Malwarebytes Anti-Exploit\MBAE.dll
2013-07-18 11:57:56 - DLL Injection has been successfully started  C:\Program Files\Malwarebytes Anti-Exploit\MBAE.dll
2013-07-18 11:57:56 - Starting Injection with: C:\Program Files\Malwarebytes Anti-Exploit\MBAE64.dll
2013-07-18 11:57:56 - DLL Injection has been successfully started  C:\Program Files\Malwarebytes Anti-Exploit\MBAE64.dll
2013-07-18 11:58:25 - 0 (3824)explorer.exe (3608)Internet Explorer is now protected
2013-07-18 11:58:28 - 0 (3608)iexplore.exe (3452)Internet Explorer is now protected
2013-07-18 11:58:38 - 0 (3608)iexplore.exe (6612)Internet Explorer is now protected

 

I will attempt to repeat the procedure and see if I can get the latest build to install this time.  Will let you know how it goes....
 

[Firefox]

OK I got the new build working except.....

1. uninstalled version 0.9.2.1200

2. Rebooted

3. Deleted folder in Program Files

4. installed version 0.9.2.1400

Install went well this time. This is what I noticed:

1. There is still a desktop icon and in the all programs shortcut that points to "C:\Program Files\Malwarebytes Anti-Exploit\mbae64.exe" which does not exist so the shortcut needs to be modified.

2. It now runs fine even after I rebooted the computer twice.

3. The glitch that it crashes IE 10 with Google Toolbar installed if I try and type something in the search box in the Google toolbar is still present. So if I am going to use the search feature in the toolbar I have to remember to exit MBAE first or I will crash the IE browser window.

Event Viewer Details when the crash happens:

Event ID: 1000

Faulting application name: iexplore.exe, version: 10.0.9200.16635, time stamp: 0x51b7a8e3

Faulting module name: MBAE64.dll_unloaded, version: 0.0.0.0, time stamp: 0x51d296f2

Exception code: 0xc0000005

Fault offset: 0x000007fee9a973d0

Faulting process id: 0x111c

Faulting application start time: 0x01ce83e4c470a116

Faulting application path: C:\Program Files\Internet Explorer\iexplore.exe

Faulting module path: MBAE64.dll

Report Id: 44ac79fe-efd8-11e2-8dd7-001e4fe52fdd

Here is the mbae-default.log log....

2013-07-18 13:21:45 - The Malwarebytes Anti-Exploit task scheduler has been successfully created

2013-07-18 13:21:46 - Malwarebytes Anti-Exploit Driver Installed successfuly

2013-07-18 13:21:46 - Malwarebytes Anti-Exploit Driver is running

2013-07-18 13:21:46 - Starting Injection with: C:\Program Files\Malwarebytes Anti-Exploit\MBAE.dll

2013-07-18 13:21:47 - DLL Injection has been successfully started C:\Program Files\Malwarebytes Anti-Exploit\MBAE.dll

2013-07-18 13:21:47 - Starting Injection with: C:\Program Files\Malwarebytes Anti-Exploit\MBAE64.dll

2013-07-18 13:21:47 - DLL Injection has been successfully started C:\Program Files\Malwarebytes Anti-Exploit\MBAE64.dll

2013-07-18 13:23:17 - 0 (4000)explorer.exe (6652)Internet Explorer is now protected

2013-07-18 13:23:18 - 0 (6652)iexplore.exe (1652)Internet Explorer is now protected

2013-07-18 13:23:40 - Stopping Injection with: MBAE.dll

2013-07-18 13:23:47 - Stopping Injection with: MBAE64.dll

2013-07-18 13:23:54 - Malwarebytes Anti-Exploit Driver stopped successfuly

2013-07-18 13:23:54 - Malwarebytes Anti-Exploit Driver has been successfully uninstalled

2013-07-18 13:29:07 - The Malwarebytes Anti-Exploit task scheduler has been successfully created

2013-07-18 13:29:08 - Malwarebytes Anti-Exploit Driver Installed successfuly

2013-07-18 13:29:08 - Malwarebytes Anti-Exploit Driver is running

2013-07-18 13:29:08 - Starting Injection with: C:\Program Files\Malwarebytes Anti-Exploit\MBAE.dll

2013-07-18 13:29:08 - DLL Injection has been successfully started C:\Program Files\Malwarebytes Anti-Exploit\MBAE.dll

2013-07-18 13:29:09 - Starting Injection with: C:\Program Files\Malwarebytes Anti-Exploit\MBAE64.dll

2013-07-18 13:29:09 - DLL Injection has been successfully started C:\Program Files\Malwarebytes Anti-Exploit\MBAE64.dll

2013-07-18 13:29:44 - 0 (2032)ObjectDock.exe (4380)Internet Explorer is now protected

2013-07-18 13:29:48 - 0 (4380)iexplore.exe (3744)Internet Explorer is now protected

2013-07-18 13:29:59 - 0 (4380)iexplore.exe (6592)Internet Explorer is now protected

2013-07-18 13:30:36 - 0 (4380)iexplore.exe (6928)Internet Explorer is now protected

2013-07-18 13:30:53 - 0 (4380)iexplore.exe (6536)Internet Explorer is now protected

2013-07-18 13:31:13 - 0 (4380)iexplore.exe (1744)Internet Explorer is now protected

2013-07-18 13:31:18 - Stopping Injection with: MBAE.dll

2013-07-18 13:31:25 - Stopping Injection with: MBAE64.dll

2013-07-18 13:31:32 - Malwarebytes Anti-Exploit Driver stopped successfuly

2013-07-18 13:31:32 - Malwarebytes Anti-Exploit Driver has been successfully uninstalled

[pbust]

Thanks for the info Firefox. Specially the tip about the IE crash not happening in the previous version. We are looking for the problem right now.

[Firefox]

Your welcome, I gave you the event viewer error above that tells you the faulting dll file.

Let me know if you need me to test something else, unless you were able to replicate the issue on your end?

[pbust]

Yes, we replicated. Thanks again. If we need anything else I'll contact you.

 

Again thanks for all your help!!