pkolasa Posted November 24, 2013 ID:757393 Share Posted November 24, 2013 Hello, I have just come across a false positive between avast! (version 2014.9.0.2008, latest) and MBAE (also latest, 0.09.4.2000) on one of the computers I manage (Windows XP SP3). When avast! detects an infected file being downloaded from Web it displays a warning (sorry, but my workstations are mainly in Polish), like this:When I click on the blue button named Więcej informacji (More information) it should open Firefox (which is default browser) with details. Instead, a warning from MBAE shows up, saying that an exploit has been blocked. Firefox with details never shows. This is how it looks in the Logs tab:I also attach mbae-default.log file. If I could be of help in this case, let me know. Greetings!mbae-default.log Link to post Share on other sites More sharing options...
pkolasa Posted November 24, 2013 Author ID:757396 Share Posted November 24, 2013 A small update (sorry for posting one after the anoter, but I can't see any Edit button):This seems to be a wider problem with avast!. It occurs when I click on any button causing default browser to open (such as Aktualizuj, Update in English in the following window):I have also noticed that MBAE blocks the attempt only if there is no other Firefox window opened. It it is, requested by avast! webpage shows up.I have also attached newer version of mbae-default.log.mbae-default.log Link to post Share on other sites More sharing options...
Staff pbust Posted November 24, 2013 Staff ID:757408 Share Posted November 24, 2013 Tried replicating with no success: * Windows XP SP3* MBAE 0.09.4.2000* Avast Free AV latest version fully up-to-date* Latest Firefox set as default browser Can you please try uninstalling and re-installing MBAE to see if it makes a difference? Do you have Avast hardened mode on? Also it would be nice if you can post or PM me a DDS log. Link to post Share on other sites More sharing options...
pkolasa Posted November 24, 2013 Author ID:757459 Share Posted November 24, 2013 It seems that MBAE blocked avast's requests due to indeed enabled hardening mode. I disabled it and MBAE didn't block any of the avast request. However, I rebooted to ensure that the hardening mode is really turned off. After the reboot, when I tried to start Firefox from Start Menu, I also encountered a popup from MBAE telling me that an exploit has been blocked. This happened just once, after closing popup and starting Firefox again, there were no popups. Reinstalling MBAE doesn't change anything, regardless of hardening mode turned on or off. I am attaching DDS (7zip packed) and another copy of mbae-default.log.DDS.7zmbae-default.log Link to post Share on other sites More sharing options...
Guest Sentoryn Posted November 24, 2013 ID:757497 Share Posted November 24, 2013 Hi, the file you wanted to download is not a false alarm, the only real threat and the response was correct Avast and MBAMI am providing a sample and url. VT:https://www.virustotal.com/pl/file/61dfd5cf108aab704d1ad3a44d34ec8ed49e89ce6a641817a0117f77652b19a9/analysis/ URL.zip Link to post Share on other sites More sharing options...
Staff pbust Posted November 25, 2013 Staff ID:757726 Share Posted November 25, 2013 Hi Sentoryn, I think you posted this in the wrong thread. Here we are discussing MBAE, not MBAM. Link to post Share on other sites More sharing options...
Staff pbust Posted November 25, 2013 Staff ID:757728 Share Posted November 25, 2013 @pkolasa, I'm going to PM you a version with special logging and instructions. Link to post Share on other sites More sharing options...
Recommended Posts