[SOLVED] MBAE64.dll_unloaded error with Wscript

[Anshi]

This is my first post in MalwareBytes Forum,

 

I had been using MBAE Beta for quite sometime till I discovered the latest version 1:04:1:1012 yesterday. I  immediately downloaded this version in the same  folder as the Beta version, my parttion D Drive. Thereafter, in the Event Viewer, I got the following error

 

Faulty Application Name W Script exe. version 5.8.7601.19283

Faulty Module Name mbae64. dll_unloaded version 0.0.0.0.

Faultin Application Path C:\Windows\System32\W Script exe.

Faultin Module Path mbae64.dll

Event ID 1000

Level Error

Task Category {100}

 

I thought  this problem arose since I didn't  uninstall the Beta  version earlier before downloading the  new version. So I again uninstalled  MBAE and then again downloaded the above version.  The following things have been observed by me now.

1.All my batch files  and W Scripts which  used  to  work  fast, have now slowed down by a couple of seconds.

2.The frequency of the above  errors have  come down, but nonetheless, still appear in my Event Viewer. Even my Reliability Monitor indicates this as an error and thereafter all my batch files/ Wscipts [ which are  activated  by my Schedule Task ]  become slow by a couple of seconds.

 

My questions ....

 

1. Should I unstall and again install in my C Drive ?

2. What is the reason that MBAE is clashing  with  WScipt on my Computer ?

 

Can someone please help me on this

 

Anshi

 

 

 

 

 

[pbust]

Hello Anshi and welcome to the forum. We are in the process of fixing this in the upcoming MBAE 1.05.

 

As soon as we have a preview ready I can send you a beta to test.

 

In the meantime as a workaround you could at an entry at the beginning and end of your scripts to stop/start the MBAE service (net stop mbaesvc & net start mbaesvc).

[Anshi]

Thank you so much for your prompt reply.Whilst on the subject, I must inform you that  a couple of days ago, my Computer went off due to power failure. I have, since then run     cd\  chkdsk c: /r  to repair any corrupt files. 

 

This morning, I have received  errors not only as mbae64  being the  faulting module name  but also from wshom.ocx version 5.8.7601.18283 [ Faulting module path ~ C\Windows\ System32\wshom.ocx ] for the same Application error in WScript.

 

Summing up, I don't think MBAE, alone is the only cause of this  application error. However, I wish to inform you that  I have again run Chdsk to  repair  corrupt  files. So far   my computer is Okay. I personally feel, perhaps the power outage could be the main reason why these  files have become corrupt and leading to errors.

 

I shall give you further  information should the errors  come again.  

 

Thanking you.

 

Anshi.

 

[cxl48548]

I just finally diagnosed this same issue after a few weeks of seeing the WScript.exe engine crash while executing our domain login scripts.

 

The clue was always there in the logs, but I didn't get around to digging into them before now.

 

Log Name:      Application
Source:        Application Error
Date:          9/30/2014 11:01:37 AM
Event ID:      1000
Task Category: (100)
Level:         Error
Keywords:      Classic
User:          N/A
Description:
Faulting application name: WScript.exe, version: 5.8.7601.18283, time stamp: 0x5258a6e6
Faulting module name: mbae64.dll_unloaded, version: 0.0.0.0, time stamp: 0x541307f0
Exception code: 0xc0000005
Fault offset: 0x000007fef28b39ca
Faulting process id: 0x19f0
Faulting application start time: 0x01cfdcc7ceef6561
Faulting application path: C:\Windows\System32\WScript.exe
Faulting module path: mbae64.dll
 

 

CxL

[pbust]

We've finally fixed this in MBAE 1.05.

 

I'll send you a preview version to verify the fix.

[Anshi]

This morning , I uninstalled MBAE. Since then, this problem of WScipt  showing errors vide  Error 1000 has stopped.

 

I was getting fed up of that stupid Microsoft Window appearing, every now and then and asking me to send information to  Microsoft and that when Solutions are available [ as though ever !! ], they would  appear in my Action Centre.

 

So my only turn around was to uninstall MBAE. Well so far that error has stopped appearing in my Event Viewer and my Laptop is back to its normal speed to load Programs which  I require.

 

Now  I am waiting  for  1:05.  Could  you send me a Beta/Preview version to test it please. 

 

Thanking you.

 

Anshi

[pbust]

Hi Anshi, I did send you a beta. Please check your PMs.

[dwanthny]

Hi Anshi, I did send you a beta. Please check your PMs.

 

Any update on when you will release V1.05?  I'll be glad to have the error go away.

[pbust]

Soon enough. Please keep an eye on the Experimental forum.

[pbust]

Marking this thread as solved per PM comments confirming the fix but not locking it.

 

If any of you experience this problem please PM me for details of the fixed version.

[pbust]

This should be solved already in the new MBAE 1.05 Experimental build:

https://forums.malwarebytes.org/index.php?/topic/160317-mbae-experimental-10531010/

[pbust]

MBAE 1.05.1.1014 final version has just been released and it fixes this issue. More info:

https://forums.malwarebytes.org/index.php?/topic/161643-malwarebytes-anti-exploit-10511014/

 

Locking this thread as solved. If you need me to re-open after upgrading to 1.05 send me a PM.