[SOLVED] RedHorse CRM.exe False Positive?

[rsmtech]

We use a browser-based commercial application (Rubicon Group, LTD) that runs our business.  There is an important function that is scripted that when invoked causes either Firefox 35.0.1 or Internet Explorer 11.0.9600.16428 to crash, while MBAE throws a warning “Exploit Attempt Blocked!  Malwarebytes Anti-Exploit has blocked an exploit attempt”.  Strangely enough, when posting this message, we attempted to upload the MBAE log files using this MB forum posting tool – the Browse button for Attaching Files causes the same problem/error message!  As such, we are unable to send our log files to assist diagnosing this problem.

[rsmtech]

Further info: using your Exclusion feature in MBAE does not help.  The proper entry appears in the log file, and we can add an exclusion, but the exclusion does not then prevent the problem from occuring.

[pbust]

If you stop MBAE (right click on traybar icon) does the crash still happen?

If it doesn't then you should be able to upload logs. Please attach both MBAE and FRST logs as mentioned in the README stickie of this sub-forum.

[rsmtech]

Here are the logs requested (all .log files are combined in the one MBAE.zip file).MBAE.zip

[pbust]

Thanks for the logs. We've been seeing this same problem a bit lately and have fixed it already. The upcoming version 1.06 of MBAE will include the fix.

 

Marking this thread as solved but leaving un-locked in case other users run across the same thing.

[rsmtech]

Pedro:  Do you have an ETA on when MBAE ver. 1.06 will be released?  Are we able to download a beta of this version?

[pbust]

Not for another few weeks. But keep an eye on the Experimental sub-forum as we usually publish previews there.

[pbust]

Can you please try the new MBAE 1.06 Release Candidate and let us know if it fixes this issue:?

https://forums.malwarebytes.org/index.php?/topic/166127-mbae-106-release-candidate/

[rsmtech]

It works!  No more problems -- thank you, guys!

[pbust]

Thanks for confirming. I'll lock this thread as soled.