Jump to content

[SOLVED] MBAE won't run Part-2


kutchka
 Share

Recommended Posts

I have followed with interest the topic "MBAE won't run" by JS Hill as I have the same issue though obviously not the same as the previous thread has been fixed and closed.

 

I have 32bit Windows XP Professional (I need it for programs that are unsupported on other OS).

But the set-up differs in that I use "Avast" anti-virus and "Privatefirewall 7.0"

 

I have run Chkdsk etc. etc. and everything appears clean of disk errors and malware but when starting:

mbae-svc.exe -install I get the message:

......... CmdInstallService(600):  Malwarebytes Anti-Exploit Service failed to start.

 

Trying to start the service via services.msc momentarily starts the service (it is seen in the task list) but then stops almost immediately.

 

I have two Windows 7 64bit PCs and an old Vista 32bit PC with the same Avast & Privatefirewall 7.0 set-up and MBAE runs with no problems.

 

The only other unusual feature (of all these PCs) is that the OS & Programs are on SSDs with most everything else running on spinners using NTFS junctions.  The same set-up is used across all OS; XP, W7, WVista.

 

Any ideas about the XP failure would be gratefully received.

Thanks

 

Link to post
Share on other sites

Thank you for the welcome message.  I trust this issue and my comments will be productive. 

Whilst I understand XP is no longer supported by Microsoft, for those of us who need to retain an XP service, MBAE offers a potentially valuable layer of security, so it would be excellent if a solution could be found.

 

I enclose the requested files:

Thanks

mbae_logs.zip

Link to post
Share on other sites

  • Staff

Just to rule it out, did you completely uninstall, reboot and try a fresh install? It seems that the driver is in a pending-delete state:

mbae-svc-MainSvc(687) - 2014/06/27 - 11:55:19 - #1# - CmdDelService: ControlService error(1092): Malwarebytes Anti-Exploit Service. -     1092 - 2500mbae-svc-MainSvc(703) - 2014/06/27 - 11:55:20 - #2# - CmdDelService: Malwarebytes Anti-Exploit Service deleted. -     213 - 2500

 

Link to post
Share on other sites

  • Staff

Please open the "Local Security Settings" (Start, Run, type "secpol.msc" and hit enter). You will see a screen like the one below. Expand the "Local Policies" tree and right-click and Export List under both the "User Rights Assignament" and "Security Options" branches. Please attach or PM me the two exported lists.

 

post-141843-0-55173800-1404259258_thumb.

 

Also I'm attaching an updated mbae-support.exe tool. Please run this one again and attach your new mbae-default.log file.

 

Thanks for your patience!

 

mbae-support.rar

Link to post
Share on other sites

  • 2 weeks later...

Hello again,

Curiously, I have just started the XP PC again and now I have the MBAE icon in the task bar and clicking on it confirms the service is running.

This is the first I have seen this.

I can confirm that since posting the logs above I have not added nor removed any software nor done anything other than normal PC use.

And, since there is no support for XP, there have been no OS updates either.

I am at a loss to explain this phenomenon and I have been in computing (& programming) long enough to know that systems do not self-repair (at least currently).

I have manually stopped and restarted the service several times with no issue.

So I trust it is cured but I have absolutely no idea why.

I am happy to continue monitoring this issue.

Regards 

Link to post
Share on other sites

  • Staff

Hi kutchka, even though I'm happy to hear it is working, I would have preferred to find out the root of the problem.

 

We were able to replicate a very similar installation problem under XP and pinpointed it to another product which uses an old version of the same hooking framework we use.

 

Could you please open the registry and export the entire HKLM\SYSTEM key and send it to me via PM? It would be nice to find if there is another piece of software that uses the same hooking framework as we do.

 

post-141843-0-81724400-1405544126_thumb.

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
 Share

  • Recently Browsing   0 members

    No registered users viewing this page.

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.