[SOLVED] MBAE and Avast conflict under Windows XP with Firefox "Save As"

[Blue Gascon]

Hello all - I just noticed this odd behavour in Firefox 27.0. When MBAE is active I cannot use Tools>Options to change the download folder location. Attempting to use the Browse button in the dialog box does NOT produce a folder list to let you specify a download folder. Additionally, if you check the option to "Always ask me where to save files" and you attempt a download a folder list WILL NOT appear and you can therefore not complete a download. Using the MBAE tray icon and selecting "Stop protection", then restarting Firefox allows you to both browse to a download folder to specify it and use the "Always ask me where to save files" option. Both srettings will produce a folder list dialog as long as MBAE protection is stopped.

 

This is pretty ugly, as I have always kept Firefox set to prompt for a download location. Having to use a specific named download folder exclusively means I have to cut and paste any download to get it into the folder I want it in.

 

Obviously this is not a show stopper but it sure is an annoyance!

[Francois_Blais]

What version of MBAE are you using?

[pbust]

Also please attach your MBAE logfile:

C:\Program Files\Malwarebytes Anti-Exploit\mbae-default.log

[ritchie58]

That is rather strange! Out of curiosity I just attempted to do the same thing with my FF 27 browser and had no problems switching back and forth from both download options or to specify a cretain folder to use for downloads. This may not be a problem with A-E but rather a corrupted Firefox Profile or Chrome issue maybe.

[daledoc1]

@ Blue Gascon:

 

Caveat: I don't use MBAE yet.

 

However, in addition to the suggestions by the others....

 

Subtle and weird things in Fx are often the result of extensions.

 

What happens when you try Mozilla Safe Mode?

This is entirely reversible and burns no bridges.

 

Next step would be something like a new, clean, "test profile", e.g. per "Standard Diagnostic".

That would also exclude corruption in your existing profile.

 

Just a thought,

 

daledoc1

 

[Blue Gascon]

Performed COMPLETE removal of Firefox 27.0, including hunting down and removing registry artifacts. Also COMPLETELY removed MBAE. Installed Firefox 27.0 from a fresh download and MBAE 0.09.5.1000, also from a fresh download. With a completely new, clean, blank FF profile the behavour still persists.

 

On further reflection it occured that I also had HitmanPro.Alert BETA 2.5 installed. Completely removed that, no effect. Downloaded and installed new BETA 2.6 - no change.

 

If I use the MBAE tray icon and Stop Protection, all functions as expected in FF 27.0 after a restart of the application. But if I re-enable MBAE protection the issue returns. As I said, not a show stopper, but a real annoyance in terms of my reflex work habits. I am happy to gather and post any info that may help in the interest of forwarding development of MalwareBytes products. Anything that can help the GOOD GUYS!

 

Antivirus is Avast Internet Security (program verson 2014.9.0.2013, definition version 140213-1).

 

Internet Explorer (8.0.6001.18702) seems unaffected. Downloads disply a folder dialog.

 

Just switched FF to "Always ask me where to save files" and attempted to download mbae-test.zip from https://forums.malwarebytes.org/index.php?showtopic=139368.

 

Initial dialog came up :

 

 

 

But selecting OK just gave an hourglass, then dialog closed. File never downloaded. This took place at about 2014-02-13 18:38:10.

 

Tried to attach mbae-default.log, but Browse is not working in this forum either. Content is included below. I see nothing that looks out of the ordinary, but I am unfamiliar with normal log appearance:

 

EDIT PBUST: inserted log as attachment instead of inline.

mbae-default.log

[Blue Gascon]

Overall it appears that something is dis-allowing browse access to the file sytem from Firefox when MBAE protection is active. From a purely secrity point of view this is a good thing! Perhaps I've managed to incorporate a desirable feature and will just adjust my work habits to enjoy even more robust protection!

[Blue Gascon]

Definately a bigger problem than initially thought - cannot browse file system at all from within Firefox while MBAE protection is active. This includes trying to usre the File>Open menu from within Firefox. This is abig problem as I do some web page development for my employers site and sometimes work locally on this machine. Also, services like FileConvoy.com that need file system browsing to specify files to upload will not work. These things WOULD be show stoppers for me. I'm really interested in following this, as I am responsible for IT functions at my firm and would love to see this product become viable commercially. I would likely deploy this enterprise wide once it is fully stable.

 

I do not have a lot of junk plugins or extensions in FF so I doubt that is the problem. And again, this is with a FRESH FF 27.0 install, even with a clean test profile. After testing the clean profile I did restore bookmarks, etc from a Mozilla backup of my old profile that was made before removing FF. I will create another clean test profile and report results.

[Blue Gascon]

OK - created new completely clean profile. Started FF in safe mode. Issue persists. Just started FF, went to Tools>Options, and tried to Browse to specify a download folder. No good, no folder list. Good thing we are getting slammed with a snowstorm today, it gave me time to experiment.

[Blue Gascon]

Using Stop Protection from MBAE tray icon and restarting FF with clean profile restores normal behavour - Tools>Options browse function for downloads location works perfectly.

[pbust]

Can you please try uninstalling Hitmanpro.Alert and rebooting your computer to see if the behavior continues?

[Blue Gascon]

Removed HitManPro.Alert - no change. Added an exception to Avast Internet Security for C:\Program Files\Malwarebytes Anti-Exploit - no change. Something in MBAE is stopping browse access to the file system in FF

[pbust]

Please download and run DDS diagnostics tool and post the logs here. Maybe there is something else conflicting with MBAE.

[Blue Gascon]

DDS ran. Files attached. BTW - had to stop MBAE protection to attach files here.

dds.txt

attach.txt

[pbust]

Could you please do the following:

 

Create a Process Monitor capture while saving a file with FF when MBAE is deactivated/stopped. Save the capture

Create a new Process Monitor capture doing the same thing with MBAE activated/started. Save the capture.

 

Compress and upload the captures either here or via some file sharing site. You can PM me the links directly if you prefer.

[Blue Gascon]

Captures attached in 7zip format. I'm done for tonight. I will check in tomorrow night. Thanks for all your efforts, I hope we can figure this out.

captures.7z

[Blue Gascon]

Anything else I can supply to further this?

[pbust]

I'm going to send you an internal version so you can test that. Please check your PMs.

[Blue Gascon]

Sorry I took so long. My account here is tied to my work email address and we are closed Saturdays. I checked messages tonight and saw your reply.

I removed the old version of MBAE, then rebooted and removed the application directory as in your instructions.I even took the extra step of running CCleaner to try to insure that all orphan artifacts were removed. Just for information, here is what CCleaners registry cleanup removed:

Unused File Extension    .dat    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dat
Installer Reference Issue    C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders
Installer Reference Issue    c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\chrome    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders
Installer Reference Issue    c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\defaults\preferences    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders
Installer Reference Issue    c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\defaults    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders
Old Start Menu key    HitmanPro.Alert    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\HitmanPro.Alert
Old Start Menu key    Malwarebytes Anti-Exploit    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\Malwarebytes Anti-Exploit
Missing MUI Reference    C:\Program Files\HitmanPro.Alert\hmpalert.exe    HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache
Missing MUI Reference    C:\DOCUME~1\Pete\LOCALS~1\Temp\is-EGFCH.tmp\mbae-setup-0.09.5.1000.tmp    HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache
Missing MUI Reference    C:\Program Files\Malwarebytes Anti-Exploit\mbae.exe    HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache
Missing MUI Reference    C:\Program Files\Malwarebytes Anti-Exploit\unins000.exe    HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache
Missing MUI Reference    C:\DOCUME~1\Pete\LOCALS~1\Temp\_iu14D2N.tmp    HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache
Missing MUI Reference    C:\Program Files\Malwarebytes Anti-Exploit\mbae-uninstaller.exe    HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache

I then performed another full shutdown and cold reboot, then installed the fresh version from the file you sent. Unfortunately the issue persists. With MBAE protection active I cannot use browse functions from within Firefox 27.0. Again stopping protection from the MBAE tray icon and restarting Firefox restores the browse functions within Firefox.

Sorry to report this, but I guess it's better to discover such things in the testing phases of the product. I'm not new to troubleshooting, but this one has me stumped.

Let me know if you want to continue. I am purposely not making any changes to the computer except those that you and I discuss.

[pbust]

Can you please ZIP all the files in the logs directory and either attach them here or PM them to me? These logs, dat and xpe files from the new version should allow us to see what the problem is.

[Blue Gascon]

Sorry, I was otherwise occupied last night and could not work on this. Are the log files located at C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes Anti-Exploit\? This is the only place I see filres with those extensions - there is no "logs" directory. I have attached the files I found there.

[Blue Gascon]

Sorry, I was otherwise occupied last night and could not work on this. I guess you are talking about the files at C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes Anti-Exploit\, as there is no "logs" directory. Here are the files from that location.

Malwarebytes Anti-Exploit.7z

[Blue Gascon]

Not quite awake yet this morning. It occurred to me that the files I attached might not help because I don't know when a download was last attempted.
I just nade sure that MBAE protection was active and switched FF to "Always ask me where to save files" and attempted to download mbae-test.zip from https://forums.malwa...howtopic=139368.

Initial dialog came up but selecting OK just gave an hourglass, then dialog closed. File never downloaded. This took place at about 2014-02-18 06:54.
New attachment is from files right after that action. Hope this makes it easier.

Malwarebytes Anti-Exploit.7z

[pbust]

Many thanks, we will look at this asap!

[Blue Gascon]

As per our conversations, see attached file.

Malwarebytes Anti-ExploitSPECIAL.7z