[SOLVED] MBAE 1.06.1.1018 in Windows 10 build 10049

[John A]

Sorry I missed the beta testing of this version, I didn't know it was on.

 

Windows 10 Build 10049, Defender

 

Installed MBAE 1.06.1.1018 over the earlier release version of MBAE [see correction in later post], then serious problems occurred with Windows 10 on subsequent startups:

- Windows Apps disappearing during app startup

- Sudden spontaneous system restarts soon after login

 

Managed to remove MBAE and the spontaneous restarts have stopped but one app still disappears on startup. 

 

I haven't made any other changes recently.

mbae.zip

[pbust]

This is very weird John. MBAE does not interfere with the OS bootup or startup applications in any way. It simply injects into the shielded apps.

 

Are any of your startup applications protected by MBAE, either by default or with custom shields?

 

Also these spontaneous system restarts what are they due to? Take a look at the Windows Event Viewer (and possibly export and send it to me via PM).

[John A]

Event logs sent.  I need to do more work on these issues as the MBAE installation may be coincidental.

[John A]

Correction

I reimaged Windows 10 build 10049 to a couple of weeks ago then realised that the earlier version of MBAE had not been installed on that build, so MBAE 1.06.1.1018 was in fact a clean install. I will run it for a few days without MBAE and see if these issues occur.

[Ztruker]

After I upgraded from Windows 10 TP build 10041 to build 10049, MBAE will not start at boot. I get this error in Event Viewer:

 

 

Log Name:      System

Source:        Service Control Manager

Date:          4/5/2015 2:34:41 PM

Event ID:      7000

Task Category: None

Level:         Error

Keywords:      Classic

User:          N/A

Computer:      Laptop

Description:

The Malwarebytes Anti-Exploit Service service failed to start due to the following error:

The service did not respond to the start or control request in a timely fashion.

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

  <System>

    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />

    <EventID Qualifiers="49152">7000</EventID>

    <Version>0</Version>

    <Level>2</Level>

    <Task>0</Task>

    <Opcode>0</Opcode>

    <Keywords>0x8080000000000000</Keywords>

    <TimeCreated SystemTime="2015-04-05T18:34:41.213253100Z" />

    <EventRecordID>11429</EventRecordID>

    <Correlation />

    <Execution ProcessID="724" ThreadID="464" />

    <Channel>System</Channel>

    <Computer>Laptop</Computer>

    <Security />

  </System>

  <EventData>

    <Data Name="param1">Malwarebytes Anti-Exploit Service</Data>

    <Data Name="param2">%%1053</Data>

    <Binary>4D006200610065005300760063000000</Binary>

  </EventData>

</Event>

 

If I open Services and start MBAE service then it works fine. Just won't start at  boot.

 

I uninstalled and reinstalled MBAE, no help.

[Ztruker]

Doesn't seem to be any way to edit a post, so ...

 

The actual error message I get a few minutes after boot is this:

 

[pbust]

Thanks for posting!

 

Can you please post your MBAE logs? Instructions here:

[README FIRST] >>> Posts here need to include MBAE logs <<<

[Ztruker]

Sorry, should have done that with my first post.

 

MBAE Logs: MBAE-logs.zip

 

[Ztruker]

Here  is hardware info:

 

Dell Inspiron 15R 5520
Processor    Intel® Core i3-3110M CPU @ 2.40GHz, 2400 Mhz, 2 Core(s), 4 Logical Processor(s)
System Type    x64-based PC
BIOS Mode    UEFI
OS Name    Microsoft Windows 10 Pro Technical Preview
Version    10.0.10049 Build 10049

 

Installed Physical Memory (RAM)    6.00 GB

Hyper-V - VM Monitor Mode Extensions    Yes
Hyper-V - Second Level Address Translation Extensions    Yes
Hyper-V - Virtualization Enabled in Firmware    Yes
Hyper-V - Data Execution Protection    Yes

Description    Disk drive
Manufacturer    (Standard disk drives)
Model    ST500LM012 HN-M500MBB
Bytes/Sector    512
Media Loaded    Yes
Media Type    Fixed hard disk
Partitions    7

Drive    C:
Description    Local Fixed Disk
Compressed    No
File System    NTFS
Size    251.03 GB (269,541,408,768 bytes)
Free Space    209.33 GB (224,768,602,112 bytes)
Volume Name    Laptop_C
Volume Serial Number    F8889014
    
Drive    D:
Description    Local Fixed Disk
Compressed    No
File System    NTFS
Size    201.27 GB (216,109,707,264 bytes)
Free Space    194.22 GB (208,541,192,192 bytes)
Volume Name    Laptop_D
Volume Serial Number    0CBC0E07
    
Drive    E:
Description    CD-ROM Disc
 

[John A]

This is very weird John. MBAE does not interfere with the OS bootup or startup applications in any way. It simply injects into the shielded apps.

Just to clarify this, it was not the Startup apps that were failing. The "Windows apps" I refer to are what used to be called "Metro" or "Modern" apps (Microsoft is now calling them "Windows apps"). Apps such as Weather, News etc were disappearing during startup.

[John A]

Well, after doing a Refresh of Windows 10 10049 x 32 and confirming that it was working normally after a full day of normal use, I reinstalled MBAE and everything is still working normally (except for the known glitches in Windows 10!).

So what went wrong? I don't know as I can't replicate it. Something appears to have severely corrupted Windows 10 around the time that I installed MBAE, but it most likely was something other than MBAE that caused it.

[pbust]

Thanks for the follow-up John. We will continue taking a look at the new Windows 10 TPs to make sure everything is ok before the final release of Windows 10.

[Ztruker]

I can no longer re-produce the problem. The last 2-3 boots MBAE has started okay with no errors. All I did was update Windows Defender definiton files and I don't see that causing this problem.

 

No idea what happened or why or why it's now working.

[pbust]

Maybe during the upgrade of Windows 10 to the new build it disables certain services from startup. We'll keep monitoring to see what's up with it. Also keep in mind Windows 10 is still beta, so these things are to be expected.

[pbust]

Merging these two threads together.

[John A]

I can no longer re-produce the problem. The last 2-3 boots MBAE has started okay with no errors. All I did was update Windows Defender definiton files and I don't see that causing this problem.

 

No idea what happened or why or why it's now working.

Many weird things happen in Windows 10! I hope we soon receive a stable build to test.

[John A]

So what went wrong? I don't know as I can't replicate it. Something appears to have severely corrupted Windows 10 around the time that I installed MBAE, but it most likely was something other than MBAE that caused it.

It looks like this issue was caused by a failing power supply and hard disk, both of which I have replaced.

I reinstalled Windows 10 x 32 B10041, updated to B10049, installed MBAE and have had no MBAE issues so far.

So MBAE wasn't the cause of this.

[pbust]

Cool thanks for the heads up John.

 

I'll close this thread as solved but we will continue to monitor the situation as we have introduced heavy Win10 compatibility testing in MBAE QA.