Jump to content

[SOLVED] Program failure


John A

Recommended Posts

AntiExploit failed with the following details.  At the time I was using IE10 and accessing  http://www.myrta.com/wps/portal/extvp/myrta/rego/renew-transfer-rego/

 

Windows 7 x 32

MSE *

Malwarebytes Pro *

IE10

 

* with recommended exclusions

 

 

 

Faulting application name: mbae.exe, version: 0.9.4.2000, time stamp: 0x5267e260
Faulting module name: MSVCR100D.dll, version: 10.0.30319.1, time stamp: 0x4ba1dbd4
Exception code: 0xc0000005
Fault offset: 0x001159da
Faulting process id: 0x9b4
Faulting application start time: 0x01cedc57ca1a92e9
Faulting application path: C:\Program Files\Malwarebytes Anti-Exploit\mbae.exe
Faulting module path: C:\Windows\system32\MSVCR100D.dll
Report Id: 2eef077b-484b-11e3-8cd9-001a4d44f605

Log Name:      Application
Source:        Application Error
Date:          8/11/2013 6:55:50 PM
Event ID:      1000
Task Category: (100)
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      John-PC
Description:
Faulting application name: mbae.exe, version: 0.9.4.2000, time stamp: 0x5267e260
Faulting module name: MSVCR100D.dll, version: 10.0.30319.1, time stamp: 0x4ba1dbd4
Exception code: 0xc0000005
Fault offset: 0x001159da
Faulting process id: 0x9b4
Faulting application start time: 0x01cedc57ca1a92e9
Faulting application path: C:\Program Files\Malwarebytes Anti-Exploit\mbae.exe
Faulting module path: C:\Windows\system32\MSVCR100D.dll
Report Id: 2eef077b-484b-11e3-8cd9-001a4d44f605
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Application Error" />
    <EventID Qualifiers="0">1000</EventID>
    <Level>2</Level>
    <Task>100</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2013-11-08T07:55:50.000000000Z" />
    <EventRecordID>23982</EventRecordID>
    <Channel>Application</Channel>
    <Computer>John-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data>mbae.exe</Data>
    <Data>0.9.4.2000</Data>
    <Data>5267e260</Data>
    <Data>MSVCR100D.dll</Data>
    <Data>10.0.30319.1</Data>
    <Data>4ba1dbd4</Data>
    <Data>c0000005</Data>
    <Data>001159da</Data>
    <Data>9b4</Data>
    <Data>01cedc57ca1a92e9</Data>
    <Data>C:\Program Files\Malwarebytes Anti-Exploit\mbae.exe</Data>
    <Data>C:\Windows\system32\MSVCR100D.dll</Data>
    <Data>2eef077b-484b-11e3-8cd9-001a4d44f605</Data>
  </EventData>
</Event>

Link to post
Share on other sites

Sorry, I have tried a few things but I am unable to replicate this.  I am unsure what else was open at the time and I can only go so far through the car registration renewal process again because the renewal process has already occurred.

 

I will keep trying!

Link to post
Share on other sites

These two log entries occurred a couple of seconds before the crash I initially reported, I don't know if they are related.

 

Log Name:      Application
Source:        SkypeUpdate
Date:          8/11/2013 6:55:41 PM
Event ID:      101
Task Category: Service Events
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      John-PC
Description:
Service stopped.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="SkypeUpdate" />
    <EventID Qualifiers="0">101</EventID>
    <Level>4</Level>
    <Task>1</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2013-11-08T07:55:41.000000000Z" />
    <EventRecordID>23981</EventRecordID>
    <Channel>Application</Channel>
    <Computer>John-PC</Computer>
    <Security />
  </System>
  <EventData>
  </EventData>
</Event>

 

Log Name:      Application
Source:        SkypeUpdate
Date:          8/11/2013 6:55:40 PM
Event ID:      103
Task Category: Service Events
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      John-PC
Description:
SkypeUpdate service is shutting down due to idle timeout.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="SkypeUpdate" />
    <EventID Qualifiers="0">103</EventID>
    <Level>4</Level>
    <Task>1</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2013-11-08T07:55:40.000000000Z" />
    <EventRecordID>23980</EventRecordID>
    <Channel>Application</Channel>
    <Computer>John-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data>SkypeUpdate</Data>
  </EventData>
</Event>

Link to post
Share on other sites

Looking through my event log I also discovered these two entries regarding another crash of MBAE that got passed me, both occurring at the same second.

 

8 seconds before this, gupdate was reported to have run, if that is relevant.

 

I have the crash dump files available in a zip file but don't want to post them on the forum

 

This was first:

 

Log Name:      Application
Source:        Windows Error Reporting
Date:          8/11/2013 3:00:00 PM
Event ID:      1001
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      John-PC
Description:
Fault bucket , type 0
Event Name: AppHangB1
Response: Not available
Cab Id: 0

Problem signature:
P1: mbae.exe
P2: 0.9.4.2000
P3: 5267e260
P4: 9892
P5: 513
P6:
P7:
P8:
P9:
P10:

Attached files:
C:\Windows\Temp\WERF0C4.tmp.appcompat.txt
C:\Windows\Temp\WERF123.tmp.xml
C:\Windows\Temp\WERF153.tmp.WERInternalMetadata.xml
C:\Windows\Temp\WERF163.tmp.hdmp
C:\Windows\Temp\WERF2DB.tmp.mdmp

These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppHang_mbae.exe_394bc3d11bdcb3d28279eddeba15584d3fa07b4_cab_0801f344

Analysis symbol:
Rechecking for solution: 0
Report Id: 3c47b4ff-482a-11e3-8d2e-001a4d44f605
Report Status: 4
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Windows Error Reporting" />
    <EventID Qualifiers="0">1001</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2013-11-08T04:00:00.000000000Z" />
    <EventRecordID>23948</EventRecordID>
    <Channel>Application</Channel>
    <Computer>John-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data>
    </Data>
    <Data>0</Data>
    <Data>AppHangB1</Data>
    <Data>Not available</Data>
    <Data>0</Data>
    <Data>mbae.exe</Data>
    <Data>0.9.4.2000</Data>
    <Data>5267e260</Data>
    <Data>9892</Data>
    <Data>513</Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>
C:\Windows\Temp\WERF0C4.tmp.appcompat.txt
C:\Windows\Temp\WERF123.tmp.xml
C:\Windows\Temp\WERF153.tmp.WERInternalMetadata.xml
C:\Windows\Temp\WERF163.tmp.hdmp
C:\Windows\Temp\WERF2DB.tmp.mdmp</Data>
    <Data>C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppHang_mbae.exe_394bc3d11bdcb3d28279eddeba15584d3fa07b4_cab_0801f344</Data>
    <Data>
    </Data>
    <Data>0</Data>
    <Data>3c47b4ff-482a-11e3-8d2e-001a4d44f605</Data>
    <Data>4</Data>
  </EventData>
</Event>

 

Log Name:      Application
Source:        Application Hang
Date:          8/11/2013 3:00:00 PM
Event ID:      1002
Task Category: (101)
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      John-PC
Description:
The program mbae.exe version 0.9.4.2000 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.
 Process ID: ff4
 Start Time: 01cedc2fcdfa0fc7
 Termination Time: 15
 Application Path: C:\Program Files\Malwarebytes Anti-Exploit\mbae.exe
 Report Id: 3c47b4ff-482a-11e3-8d2e-001a4d44f605

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Application Hang" />
    <EventID Qualifiers="0">1002</EventID>
    <Level>2</Level>
    <Task>101</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2013-11-08T04:00:00.000000000Z" />
    <EventRecordID>23949</EventRecordID>
    <Channel>Application</Channel>
    <Computer>John-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data>mbae.exe</Data>
    <Data>0.9.4.2000</Data>
    <Data>ff4</Data>
    <Data>01cedc2fcdfa0fc7</Data>
    <Data>15</Data>
    <Data>C:\Program Files\Malwarebytes Anti-Exploit\mbae.exe</Data>
    <Data>3c47b4ff-482a-11e3-8d2e-001a4d44f605</Data>
    <Binary>430072006F00730073002D00740068007200650061006400000044006500610064006C006F0063006B0000000000</Binary>
  </EventData>
</Event>

Link to post
Share on other sites

Another crash occurred today...

 

Log Name:      Application
Source:        Application Error
Date:          9/11/2013 9:48:38 AM
Event ID:      1000
Task Category: (100)
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      John-PC
Description:
Faulting application name: mbae.exe, version: 0.9.4.2000, time stamp: 0x5267e260
Faulting module name: MSVCR100D.dll, version: 10.0.30319.1, time stamp: 0x4ba1dbd4
Exception code: 0xc0000005
Fault offset: 0x000f32a4
Faulting process id: 0xa48
Faulting application start time: 0x01cedcb6c6464538
Faulting application path: C:\Program Files\Malwarebytes Anti-Exploit\mbae.exe
Faulting module path: C:\Windows\system32\MSVCR100D.dll
Report Id: e79ee910-48c7-11e3-8d3b-001a4d44f605
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Application Error" />
    <EventID Qualifiers="0">1000</EventID>
    <Level>2</Level>
    <Task>100</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2013-11-08T22:48:38.000000000Z" />
    <EventRecordID>24170</EventRecordID>
    <Channel>Application</Channel>
    <Computer>John-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data>mbae.exe</Data>
    <Data>0.9.4.2000</Data>
    <Data>5267e260</Data>
    <Data>MSVCR100D.dll</Data>
    <Data>10.0.30319.1</Data>
    <Data>4ba1dbd4</Data>
    <Data>c0000005</Data>
    <Data>000f32a4</Data>
    <Data>a48</Data>
    <Data>01cedcb6c6464538</Data>
    <Data>C:\Program Files\Malwarebytes Anti-Exploit\mbae.exe</Data>
    <Data>C:\Windows\system32\MSVCR100D.dll</Data>
    <Data>e79ee910-48c7-11e3-8d3b-001a4d44f605</Data>
  </EventData>
 

Link to post
Share on other sites

I have just noticed that MBAE reports 3 blocked exploit attempts (see image).  Yet there is no record of any of these in the logs, and I have received no advices from MBAE about these.

 

What is interesting is that it has crashed 3 times - I therefore wonder if the crashes occured after detecting an exploit during the blocked exploit processing.

post-14642-0-09820500-1383970964_thumb.j

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.