Jump to content
tigz1218

[SOLVED] ASUS Xonar sound GX driver conflict prevents opening IE and Firefox

Recommended Posts

Hello,

 

I just installed this program and now everytime i try to open IE or Firefox it says explot attempt blocked. I restarted my computer and reinstalled MBAE and it is still occuring. I have since had to disable to product so I can use the internet.

Share this post


Link to post
Share on other sites

Welcome to the forum and thanks for posting tigz1218

 

Can you please create a ZIP file with the contents of "C:\ProgramData\Malwarebytes Anti-Exploit" and attach it here?

 

When replying, click the "More Reply Options" on the bottom right and you'll be able to attach the ZIP file here.

 

Thanks!

Share this post


Link to post
Share on other sites

Try copying the directory "C:\ProgramData\Malwarebytes Anti-Exploit" to another location like MyDocuments and then ZIP it from there.

Share this post


Link to post
Share on other sites

Close, but no banana! :)

 

You ZIP'ed the directory C:\Program Files (x86)\Malwarebytes Anti-Exploit\

 

The one I need is C:\ProgramData\Malwarebytes Anti-Exploit\

 

Thanks!

Share this post


Link to post
Share on other sites

We've seen this problem in the past with the ASUS video card application:

 

C:\Windows\SysWOW64\HsMgr.exe
C:\Windows\System\HsMgr64.exe

 

Try the following:

 

1- Using Process Explorer or other process management tool, kill those 2 processes

2- Try again

 

Does that solve the problem?

Share this post


Link to post
Share on other sites

Wow that worked! You're good! I just have three quick questions if you don't mind.

 

By killing those two process is it going to impact my pc in anyway?

Will I need to kill them everytime I restart my PC?

Is this bug going to be addressed in a future relese?

 

Thank you again!!!!

Share this post


Link to post
Share on other sites

Thanks for troubleshooting and reporting back here.

 

You can safely use Microsoft autoruns (run as admin) to disable HsMgr.exe and HsMgr64.exe from running at boot. This will effectively solve the problem.

 

These files are from "C-Media Electronics Inc." from China or Taiwan and are preloaded in some ASUS models to provide GX2.0 features. The applications were built in 2008, are not digitally signed, show incorrect or no resource information and perform some really crappy and low quality API hooking.

 

Conflicts are known to show up not only with MBAE but also with other programs.

HsMgr.exe causes conflicts

HsMgr.exe causes conflicts (2)

http://answers.microsoft.com/en-us/windows/forum/windows_7-windows_programs/control-panel-msn-problem/266cafff-d552-4f2d-84bf-07490811be74

Video and sound streaming croppy because of HsMgr.exe

 

This application is so crappily coded that it should almost be detected as malware, or at the very least PUP.

 

Other references:

https://www.virustotal.com/en/file/ed7f382f517bf8c33e8ef31b2e5e6a64ef6964de4b22e8ddde77b798b01a4d01/analysis/1415209150/

https://www.virustotal.com/en/file/ed7f382f517bf8c33e8ef31b2e5e6a64ef6964de4b22e8ddde77b798b01a4d01/analysis/1415209150/

https://www.virustotal.com/en/file/c6d275b4993502a155f85d8de26b119866dee106c98cf29cdaacbaf11484c94a/analysis/1417885743/

https://www.virustotal.com/en/file/c6d275b4993502a155f85d8de26b119866dee106c98cf29cdaacbaf11484c94a/analysis/1417885743/

https://www.virustotal.com/en/file/ed7f382f517bf8c33e8ef31b2e5e6a64ef6964de4b22e8ddde77b798b01a4d01/analysis/1415209150/

https://www.virustotal.com/en/file/ed7f382f517bf8c33e8ef31b2e5e6a64ef6964de4b22e8ddde77b798b01a4d01/analysis/1415209150/

Share this post


Link to post
Share on other sites

By the way, if you find out what the entry in Control Panel -> Uninstall looks like for HsMgr please do let us know so we can advise other users to uninstall it.

Share this post


Link to post
Share on other sites

Hi guys,  just following along and have to say some good information Pedro. :)

Share this post


Link to post
Share on other sites

Thank you so much for all of this info, you are awesome. I will look into it and see if I can find the uninstall entry and will report back. Based on some further research I just did, I found out that Asus Xonar Soundcard Drivers apparently install this 3rd party software. I will unstall the Xonar drivers and see if HSmgr is removed as well. Will report back shortly.

 

Please don't close thread as solved yet :)

Share this post


Link to post
Share on other sites

Okay so I removed my Asus Xonar drivers and the HsMgr software was removed. Asus apparently uses it to produce GX Mode and VoiceFX.

 

Now I have no sound, and don't feel like plugging my nice speakers into the crappy onboard audio. Trying to see if I can find a driver install without that crapware.

 

Source: http://vip.asus.com/forum/view.aspx?id=20110815143253702&board_id=21&model=Xonar+DX&page=1&SLanguage=en-us

 

Stay tuned...

Share this post


Link to post
Share on other sites

Great news...

 

I found other Asus Xonar drivers on the web that do not install HsMgr. The sound even seems a little bit crisper (or maybe I am just happy I found something and I am being biased.)

 

If you were running into the same issues as me I suggest uninstalled the offical Asus Xonar Drivers and giving UNI Xonar Drivers a shot.

Link: http://maxedtech.com/asus-xonar-unified-drivers/

 

I installed them with the C-Media Panel option, with GX DISABLED. Do not install it with GX enabled or you may got stuck with the HsMgr software. As always read the FAQs and install instructions before giving it a shot.

 

pbust, thank you for your help. I hope my info has helped as well.

Share this post


Link to post
Share on other sites

This is awesome information tigz, thank you so much!!

 

I will probably create a new entry in Known Issues with all this information and change the threat title to something more descriptive of the problem.

 

Again thanks tigz for all your troubleshooting!!

Share this post


Link to post
Share on other sites

Hi I have been using a licenced copy of the previous version on two machines and it was trouble free. I updated to 1.05.1.1015 and on one machine it registers an exploit attempt as soon as I try and open Firefox or IE, the other PC does not exhibit this behaviour.

 

I tried to add the file from WinRAR but your site says I am not allowed to upload this kind of file.

 

If I disable protection I can use the computer but that means there is no anti exploit protection at all.

 

Loader.log

 

mbae-default.log

Share this post


Link to post
Share on other sites

Welcome to the forum and thanks for posting Checkpoint!

 

The log you have attached is from a very old version. Can you please attach the logs from the new version 1.05.1.1015? You will find them in C:\ProgramData\Malwarebytes Anti-Exploit.

 

More importantly, can you also run the tool FRST and attach here the resulting logs (2 files)?

http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/

 

Thanks!

Share this post


Link to post
Share on other sites

Thanks for the logs!!

 

This is the same issue as the one being discussed here.

 

The final MBAE 1.05 version, build 1016 will solve this issue. It will be released between today and tomorrow.

 

In the meantime I'll merge these posts with the existing discussion thread.

Share this post


Link to post
Share on other sites
Guest
This topic is now closed to further replies.

  • Recently Browsing   0 members

    No registered users viewing this page.

×

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.