DonZ Posted February 16, 2015 ID:940225 Share Posted February 16, 2015 WIN 7 SP1 x64, MBAM ver. 2.0.4.1028 Recently whenever I do a MBAM threat scan, it is detecting what is shown in the below screen shot. MBAM heuristics is detecting these. They occur after I modify applications within EMET 5.1. I am fairly certain these are valid registry entries that MBAM is alerting on. Link to post Share on other sites More sharing options...
Firefox Posted February 16, 2015 ID:940240 Share Posted February 16, 2015 Lets get a little more info on the system.... Please read the following and in your next reply ATTACH the 3 requested logs - Diagnostic Logs (the three files should be CheckResults.txt, FRST.txt and Addition.txt) Thank You, Firefox Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted February 16, 2015 Root Admin ID:940257 Share Posted February 16, 2015 We'd actually like to get the full log and not a screen shot. You can export it from the History, Application Log section of the program. Please export, save as text and not xml Those locations are actually not supposed to be used so odd that another Microsoft tool would be using them but I suppose it's possible. Link to post Share on other sites More sharing options...
DonZ Posted February 17, 2015 Author ID:940273 Share Posted February 17, 2015 Here's the most recent log. I thought I found the problem. For those registry keys, appears for some reason EMET did not add a DisableExceptionChainValidationKey. I added it and ran another MBAM scan but MBAM still flagged the same keys. So if you guys can't come up with a reason, I might just reinstall EMET 5.1. MBAM_log_02-160-2015.txt Link to post Share on other sites More sharing options...
DonZ Posted February 17, 2015 Author ID:940285 Share Posted February 17, 2015 Did some research. All those keys that have been quarantined are used for is setting SEHOP. So I am clueless as to why MBAM all of a sudden wants to flag them. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted February 17, 2015 Root Admin ID:940320 Share Posted February 17, 2015 Please use REGEDIT and export this Key from the registry. You can then either zip it to upload or change the .reg to .txt and attach the file. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options] If you need further help on how to do that please let me know. Link to post Share on other sites More sharing options...
DonZ Posted February 17, 2015 Author ID:940394 Share Posted February 17, 2015 Here's the reg key. Note that wininit.exe and wuauclt.exe are missing from the root since MBAM quarantined them. They are listed under the C: subkey. Appears EMET uses that C: subkey. Image_File_Execution_Options.txt Link to post Share on other sites More sharing options...
DonZ Posted February 17, 2015 Author ID:940400 Share Posted February 17, 2015 Also appears this is not a new issue? https://forums.malwarebytes.org/index.php?/topic/156567-mbam-not-getting-along-with-emet-50/ Link to post Share on other sites More sharing options...
Staff shadowwar Posted February 17, 2015 Staff ID:940404 Share Posted February 17, 2015 please restore those entries malwarebytes quarantined and reexport that key. The main problem is malware mostly uses this key to launch its program instead of the legit one. I may be able to work around this but worse case u may just have to add these to the malwarebytes exclusion list so they are no longer detected. Link to post Share on other sites More sharing options...
DonZ Posted February 17, 2015 Author ID:940408 Share Posted February 17, 2015 I restored the keys that were originally quarantined since I have now multi-quarantine entries. For what it is worth, this issue with MBAM heuristics stated a couple of days again. Prior to that all was fine. Image_File_Execution_Options_2.txt Link to post Share on other sites More sharing options...
Staff shadowwar Posted February 17, 2015 Staff ID:940411 Share Posted February 17, 2015 It has to do with emet. That def hasnt changed in over 4 years. I should have this fixed next update. Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now