[SOLVED] Trusteer Rapport blocking MBAE (was: MBAE Crashing Chrome)

[adcasa]

As soon as I updated MBAE to version 1.06.1.1019 (Free), today, Chrome started crashing. I confirmed that I have the latest version of Chrome. I "Stop(ped) Protection" and Chrome ran OK. I "Start(ed) Protection" and Chrome immediately crashed again.

 

I am running Chrome Version 42.0.2311.135 m (64-bit) on Windows 8.1.

 

I would happily attach the MBAE log files except that the Log Tab is blank.

[pbust]

Welcome to the forum adcasa.

It might have to do with the upgrade process while Chrome is running. Does the problem persist after a reboot?

[adcasa]

Excellent question! I thought I had re-booted; but, just in case, I tried that again.

 

The issue persists after a reboot. I, also, re-installed Chrome from scratch and the issue persists after that as well.

[pbust]

Let's try a reinstall of MBAE to discard the upgrade issues:

1- Close all apps (browsers, Office, etc) and make sure they are closed. Sometimes Chrome will seem closed but chrome.exe processes are still running in the background.

2- Uninstall MBAE from Control Panel.

3- Delete the MBAE logs directory (C:\ProgramData\Malwarebytes Anti-Exploit).

4- Download and install the latest version from our website.

Does the problem still persist after a reinstall?

[adcasa]

Thanks for your prompt response and suggestions.

1. Close all apps (browsers, Office, etc) and make sure they are closed. Sometimes Chrome will seem closed but chrome.exe processes are still running in the background.
   1. ​I closed all running apps.
   2. I confirmed Chrome was completely closed by watching it in Task Manager.
2. Uninstall MBAE from Control Panel.
3. Delete the MBAE logs directory (C:\ProgramData\Malwarebytes Anti-Exploit).
   1. After this, I, also, re-booted.
4. Download and install the latest version from our website.
   1. ​After downloading, I closed Chrome and confirmed it was closed before installing MBAE

Unfortunately, the issue persists, still.

[pbust]

Thanks for the feedback adcasa. Can you please post or PM me the logs from running FRST to see if there is something that might be conflicting with Chrome?

[adcasa]

I would be glad to; but, I am unfamiliar w/ FRST and do not want to assume I can find the right item. Is this a piece of Windows or a tool I can download?

[pbust]

Sorry adcasa I should have mentioned that instructions are available here:

[README FIRST] >>> Posts here need to include MBAE logs <<<

[adcasa]

Well, I should have seen that myself.

Here are the logs from both FRST and today's attempt at turning MBAE back on.

FRST_Logs.zip

mbae-PrgDtaFiles.zip

[pbust]

Thanks!

 

I see you have Trusteer Rapport. Try setting Trusteer's "Block Browser Process Alteration" setting to "never" to see if it solves the problem.

[pbust]

I also see quite a bit of Rapport crashes in your Chrome:

 

Error: (04/28/2015 06:32:47 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: chrome.exe, version: 42.0.2311.135, time stamp: 0x553eaeaa
Faulting module name: RapportGP_x64.DLL, version: 14590.0.0.0, time stamp: 0x54c90e7c
Exception code: 0xc0000005
Fault offset: 0x00000000000ff998
Faulting process id: 0x13c8
Faulting application start time: 0xchrome.exe0
Faulting application path: chrome.exe1
Faulting module path: chrome.exe2
Report Id: chrome.exe3
Faulting package full name: chrome.exe4
Faulting package-relative application ID: chrome.exe5

[adcasa]

Thanks!

 

I see you have Trusteer Rapport. Try setting Trusteer's "Block Browser Process Alteration" setting to "never" to see if it solves the problem.

At first, issue persisted; after a re-boot, issue was resolved.

 

 

I also see quite a bit of Rapport crashes in your Chrome:

 

Error: (04/28/2015 06:32:47 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: chrome.exe, version: 42.0.2311.135, time stamp: 0x553eaeaa

Faulting module name: RapportGP_x64.DLL, version: 14590.0.0.0, time stamp: 0x54c90e7c

Exception code: 0xc0000005

Fault offset: 0x00000000000ff998

Faulting process id: 0x13c8

Faulting application start time: 0xchrome.exe0

Faulting application path: chrome.exe1

Faulting module path: chrome.exe2

Report Id: chrome.exe3

Faulting package full name: chrome.exe4

Faulting package-relative application ID: chrome.exe5

Interesting, none of this is being displayed at my end and Rapport is not showing any issues in its reporting. I have submitted the above log info to IBM Trusteer.

[pbust]

Great, thanks for all your help and glad we got it working. Yes please do let IBM Trusteer know about it so they can fix it. It seems they are preventing MBAE from protecting Chrome.

 

I will close this thread as solved. But if you need me to re-open it simply send me a PM.