[SOLVED] MBAE won't run Part-2

[kutchka]

I have followed with interest the topic "MBAE won't run" by JS Hill as I have the same issue though obviously not the same as the previous thread has been fixed and closed.

 

I have 32bit Windows XP Professional (I need it for programs that are unsupported on other OS).

But the set-up differs in that I use "Avast" anti-virus and "Privatefirewall 7.0"

 

I have run Chkdsk etc. etc. and everything appears clean of disk errors and malware but when starting:

mbae-svc.exe -install I get the message:

......... CmdInstallService(600):  Malwarebytes Anti-Exploit Service failed to start.

 

Trying to start the service via services.msc momentarily starts the service (it is seen in the task list) but then stops almost immediately.

 

I have two Windows 7 64bit PCs and an old Vista 32bit PC with the same Avast & Privatefirewall 7.0 set-up and MBAE runs with no problems.

 

The only other unusual feature (of all these PCs) is that the OS & Programs are on SSDs with most everything else running on spinners using NTFS junctions.  The same set-up is used across all OS; XP, W7, WVista.

 

Any ideas about the XP failure would be gratefully received.

Thanks

 

[pbust]

Welcome to the forum and thanks for posting.

Can you please provide all logs referenced here, including DDS:
https://forums.malwarebytes.org/index.php?/topic/144403-readme-first-how-to-post-here/

 

EDIT: also run the new mbae-support.exe tool that is attached in the README FIRST post.

[kutchka]

Thank you for the welcome message.  I trust this issue and my comments will be productive. 

Whilst I understand XP is no longer supported by Microsoft, for those of us who need to retain an XP service, MBAE offers a potentially valuable layer of security, so it would be excellent if a solution could be found.

 

I enclose the requested files:

Thanks

mbae_logs.zip

[pbust]

Just to rule it out, did you completely uninstall, reboot and try a fresh install? It seems that the driver is in a pending-delete state:

mbae-svc-MainSvc(687) - 2014/06/27 - 11:55:19 - #1# - CmdDelService: ControlService error(1092): Malwarebytes Anti-Exploit Service. -     1092 - 2500mbae-svc-MainSvc(703) - 2014/06/27 - 11:55:20 - #2# - CmdDelService: Malwarebytes Anti-Exploit Service deleted. -     213 - 2500

 

[pbust]

Please open the "Local Security Settings" (Start, Run, type "secpol.msc" and hit enter). You will see a screen like the one below. Expand the "Local Policies" tree and right-click and Export List under both the "User Rights Assignament" and "Security Options" branches. Please attach or PM me the two exported lists.

 

 

Also I'm attaching an updated mbae-support.exe tool. Please run this one again and attach your new mbae-default.log file.

 

Thanks for your patience!

 

mbae-support.rar

[kutchka]

Thank you for your last 2 postings.

First above, I am sure I did (at least once) but I will do so again.

I am out on business until the weekend when I shall perform your requests; so I thank you for your patience too.

[kutchka]

Hello,

I confirm having done an uninstall, reboot & fresh install of "mbae-setup-1.03.1.1220.exe"

The problem remains.

Please find enclosed mbae-default.log plus URA & SO txt files.

Thanks 

mbae_logs-2.zip

[pbust]

Thanks for the logs @kutchka. We're still analyzing this and will get back to you as soon as possible.

[kutchka]

Hello again,

Curiously, I have just started the XP PC again and now I have the MBAE icon in the task bar and clicking on it confirms the service is running.

This is the first I have seen this.

I can confirm that since posting the logs above I have not added nor removed any software nor done anything other than normal PC use.

And, since there is no support for XP, there have been no OS updates either.

I am at a loss to explain this phenomenon and I have been in computing (& programming) long enough to know that systems do not self-repair (at least currently).

I have manually stopped and restarted the service several times with no issue.

So I trust it is cured but I have absolutely no idea why.

I am happy to continue monitoring this issue.

Regards 

[pbust]

Hi kutchka, even though I'm happy to hear it is working, I would have preferred to find out the root of the problem.

 

We were able to replicate a very similar installation problem under XP and pinpointed it to another product which uses an old version of the same hooking framework we use.

 

Could you please open the registry and export the entire HKLM\SYSTEM key and send it to me via PM? It would be nice to find if there is another piece of software that uses the same hooking framework as we do.