Jump to content

[EMET] 0.10.0100 Preventing IE 11 From Opening on W8.1 Pro

Nesivos

By Nesivos
in Anti-Exploit Beta

 Share

Recommended Posts

Nesivos

Nesivos

Posted
  • Author
Posted

Odd, not happening on mine.

 

Can you detail your settings?

Which specific settings are you inquiring about?

 

I did run MiniToolBox and it found this.

 

Application errors:

==================

Error: (04/01/2014 11:36:37 AM) (Source: Application Error) (User: )

Description: Faulting application name: IEXPLORE.EXE, version: 11.0.9600.16518, time stamp: 0x52f347b2

Faulting module name: KERNELBASE.dll, version: 6.3.9600.16496, time stamp: 0x52b3e015

Exception code: 0xc0000005

Fault offset: 0x00012c06

Faulting process id: 0xd10

Faulting application start time: 0xIEXPLORE.EXE0

Faulting application path: IEXPLORE.EXE1

Faulting module path: IEXPLORE.EXE2

Report Id: IEXPLORE.EXE3

Faulting package full name: IEXPLORE.EXE4

Faulting package-relative application ID: IEXPLORE.EXE5

Error: (04/01/2014 11:32:12 AM) (Source: ESENT) (User: )

Description: DllHost (4196) WebCacheLocal: Error -1811 (0xfffff8ed) occurred while opening logfile C:\Users\xxxxx\AppData\Local\Microsoft\Windows\WebCache\V0100051.log.

 

No problem with IE 11 on my W7-SP1 Home SDK computer

Link to post
Share on other sites
Nesivos

Nesivos

Posted
  • Author
Posted

IE settings and plugins, to be specific.

 

As in have you tried reverting IE 11 to default settings and see if it still loads?

I reset all IE 11 settings to default.  No change.  Still "stopped responding"  and then closed after about 15 seconds.

Link to post
Share on other sites
Nesivos

Nesivos

Posted
  • Author
Posted

I reset all IE 11 settings to default.  No change.  Still "stopped responding"  and then closed after about 15 seconds.

Forgot. I even rebooted after resetting all IE 11 settings to default and got the result I mentioned in the quote directly above this.

Link to post
Share on other sites
Nesivos

Nesivos

Posted
  • Author
Posted

Odd.  Two of us with no issues and you are having one.

 

What other AV/AM software are you using?

I don't think it is the AV software which is BD W8 Security though it could be.   I have no problem with Firefox and MBAE and have no problems with IE when I turn off MBAE protection.  There could be a conflict with BD W8 Security and MBAE and IE 11 when all are used in combination.  However, I have never heard of a one software causing another software to prevent a third software from running.

 

I even ran a sfc /scannow as well as dism.exe/online /cleanup-image /restorehealth. 

 

I did turn off MBAE protection open IE 11 and then try and turn on MBAE with IE 11 open and working.  The MBAE GUI began shaking and the webpage open in IE 11 went blank with IE 11 freezing.

 

I rarely use IE 11 and if I do need to use it I know I can always turn off MBAE protection.   Obviously not a solution but since I rarely use IE 11 it is no biggie to do.  I may use IE 11 once every three months at the most.   Maybe the problem will resolve itself in a future Windows patch or update or a future MBAE update.

 

Thanks for trying to help.  I appreciate it.

Link to post
Share on other sites
Nesivos

Nesivos

Posted
  • Author
Posted

I'll test in more detail on my end and see if I can replicate it.

I did some more reseach and the file that is showing up as part of the IE 11 app error is KERNELBASE.dll, version: 6.3.9600.16496,   It appears that KERNALBASE.dll might require NETFramework 3.5 which I do not have on my computer.  In fact I do not have any versions of NETFramework on my computer.

 

1.  Does MBAE require NET Framework?

2.  Do you have it installed on your computer?  

 

Thanks

Link to post
Share on other sites
  • Staff
pbust

pbust

Posted
  • Staff
Posted

No, MBAE does not require .NET or anything like that.

 

To discard any potential conflicts with BD, can you completely uninstall BD, reboot, and check if the problem with MBAE persists? This way we will know for sure if it's a problem with MBAE or a conflict with BD.

Link to post
Share on other sites
Nesivos

Nesivos

Posted
  • Author
Posted

No, MBAE does not require .NET or anything like that.

 

To discard any potential conflicts with BD, can you completely uninstall BD, reboot, and check if the problem with MBAE persists? This way we will know for sure if it's a problem with MBAE or a conflict with BD.

Thanks for the input.  I doubt it is BD since Firefox has no problem.  In fact BD W8 Security has not been updated in months other than new defintions.  There was no prolbem with IE 11 and MBAE when I was running W8 with the current version of BD W8 Security.  Even 0.095.doessn't work with IE 11 on W8.1.  It had no problem before when I was using W8.  Finally, MBAE, IE 11 and BDIS have no problems on my W7-SP1. 

Link to post
Share on other sites
Nesivos

Nesivos

Posted
  • Author
Posted

This is from this morning's MBAE log.  I don't know if it will be of any help

 

iexplore.exe_7864-2014/04/03 - 07:57:10 - C:\Program Files\Internet Explorer\iexplore.exe
mbae-svc-NoMod(100) - 2014/04/03 - 07:57:10 - #2# - IPCFromProtector: INJECTED: 1    (3108)explorer.exe    (7864)Internet Explorer is now shield -     213 - 9684
mbae-svc-NoMod(326) - 2014/04/03 - 07:57:10 - #1# - DeleteReportFile:   -     32 - 9684
mbae-svc-NoMod(512) - 2014/04/03 - 07:57:10 - #1# - AddInjectedApplication: 213 -     213 - 9684
mbae-svc-NoMod(423) - 2014/04/03 - 07:57:11 - #1# - MbaeLogProcessModules: Cannot enumerate loaded modules Pid: 7864 Process Name: C:\Program Files\Internet Explorer\iexplore.exe Address: 0x00000000 -     329 - 9684
mbae-svc-NoMod(125) - 2014/04/03 - 07:57:11 - #1# - IPCFromProtector: 213 -     213 - 9684
mbae-svc-NoMod(136) - 2014/04/03 - 07:57:30 - #2# - IPCFromProtector: UNINJECTED: 2    (3108)explorer.exe    (7864)Internet Explorer is now unshield -     213 - 9684

 

Link to post
Share on other sites
Nesivos

Nesivos

Posted
  • Author
Posted

Source of problem identified

 

I am using EMET 5.0 Technical Preivew "Beta"

 

There is a conflct between MBAE and EMET 5.0 with respect to IE 11.   The conflict can be identified by going to Apps ---->"iexplorer.exe" ---->ROP (Return Oriented Programming).  If you uncheck the five boxes in (Return Oriented Programming) ROP Mitigations

1. LoadLib
2. MemProt
3. Caller
4. SimExecFlow
5. StackPivot

 

IE 11 opens with no problem.  If any  of those five are checked IE 11 will not open with MBAE protection enabled.

Link to post
Share on other sites
Nesivos

Nesivos

Posted
  • Author
Posted

So, MBAE and EMET 5 Beta have potential issues.  Thanks for the report.  Looks like Pedro has his work cut out for him :P

I forgot to add.  'iexplorer.exe' is an included app under the EMET 5.0 default setup and all the boxes are checked by default.   The fact that both of those things are default settings in EMET 5.0 gives a different shade to things than if 'iexplorer.exe' was not included by default and/or those boxes under ROP were not checked by default but only by user choice to add into covered apps.

 

The exact same situation exist with Firefox.   The difference is Firefox is not a default app in EMET.  That is why I have had no problem with it since I had not added Firefox to EMET as a covered app.   I tested it by adding Firefox to EMET with all boxes checked.  It would not start with MBAE protection enabled.  It would start with MBAE protection disabled.  It also starts and runs with MBAE protection enabled and like IE 11 all the ROP boxes unchecked

Link to post
Share on other sites
  • Staff
pbust

pbust

Posted
  • Staff
Posted

It is normal that as we advanced MBAE core engine development it will more and more difficult to keep it compatible with EMET. Therefore we might have to revise our position of compatibility with EMET going forward and/or make a slimmed EMET-compatible MBAE version. We''ll see how things progress as MBAE core engine finishes and what the different incompatibilities are.

Link to post
Share on other sites
Nesivos

Nesivos

Posted
  • Author
Posted

It is normal that as we advanced MBAE core engine development it will more and more difficult to keep it compatible with EMET. Therefore we might have to revise our position of compatibility with EMET going forward and/or make a slimmed EMET-compatible MBAE version. We''ll see how things progress as MBAE core engine finishes and what the different incompatibilities are.

I only tested IE 11 and Firefox.  There could be conflicts with other apps that MBAE currently covers.  I have used EMET for a few years and it is defintiely becoming more robust.  While I wouldn't go so far as to say it is a must have app for Windows users it is getting awfully close to that.  One of the better 'free' consumer security apps released by Microsoft.  Of coure that isn't saying a lot :D However, it is a very good security app.

Link to post
Share on other sites
Wilpower

Wilpower

Posted
Posted

Well, explains why I hadn't seen the issues Nesivos has been very thoroughly explaining.(Not running EMET)

I also agree with the EMET assessment however I've always found the app very 'high maintenance' in the possible configurations  :D

I have used it over the years but not presently.

 

edit

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.