Firefox Posted July 6, 2015 ID:974593 Share Posted July 6, 2015 Today I tried to go build a new Dell Server at the Dell website. I need to go to premier.dell.com to login but MBAE is getting a block. Let me know if you need additional info."2015-07-02T16:54:23.773-05:00";"user";"40736";"E:\Tech CD\Utils\Ad Aware\Malwarebytes Anti-Malware\Malwarebytes Anti-Exploit v1.07.1.1010 Premium\mbae-test.exe";"8012";"explorer.exe";"2";"502";"200";"0x02FF00A0";"";"0x00020000";"0x00370000";"0x0036C000";"0x0036F37C";"";"";"";"";"""2015-07-06T16:05:50.908-05:00";"user";"4480";"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE";"7240";"iexplore.exe";"0";"513";"210";"";"";"";"";"";"";"C:\Windows\SysWOW64\vbscript.dll";"DFD9A022896EE048067C3890D820015C";"";"";"""2015-07-06T16:05:52.532-05:00";"user";"17692";"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE";"7240";"iexplore.exe";"0";"513";"210";"";"";"";"";"";"";"C:\Windows\SysWOW64\vbscript.dll";"DFD9A022896EE048067C3890D820015C";"";"";"""2015-07-06T16:06:50.276-05:00";"user";"17824";"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE";"7240";"iexplore.exe";"0";"513";"210";"";"";"";"";"";"";"C:\Windows\SysWOW64\vbscript.dll";"DFD9A022896EE048067C3890D820015C";"";"";"""2015-07-06T16:06:52.121-05:00";"user";"18428";"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE";"7240";"iexplore.exe";"0";"513";"210";"";"";"";"";"";"";"C:\Windows\SysWOW64\vbscript.dll";"DFD9A022896EE048067C3890D820015C";"";"";"" Link to post Share on other sites More sharing options...
Staff pbust Posted July 6, 2015 Staff ID:974624 Share Posted July 6, 2015 Known Issue #1:https://forums.malwarebytes.org/index.php?/topic/135127-known-issues-conflicts/ We'll probably push out a 1011 build disabling this protection while we fine-tune it. Link to post Share on other sites More sharing options...
Firefox Posted July 7, 2015 Author ID:974746 Share Posted July 7, 2015 Thanks for the info... keep up the good work... Link to post Share on other sites More sharing options...
Firefox Posted July 7, 2015 Author ID:974768 Share Posted July 7, 2015 I assume that this is the same bug for this issue as well: Go HERE and in that post you will see two smiley images, right click on them and then do properties. MBAE will produce the block and the reload the page. Link to post Share on other sites More sharing options...
Staff pbust Posted July 8, 2015 Staff ID:974876 Share Posted July 8, 2015 Is the block the same (i.e. "Attempt to execute VB Scripting blocked")? Link to post Share on other sites More sharing options...
Staff pbust Posted July 8, 2015 Staff ID:974905 Share Posted July 8, 2015 Build 1011 is out which fixes this for new installs -> https://forums.malwarebytes.org/index.php?/topic/170015-malwarebytes-anti-exploit-10711011/ For existing installs, upgrade manually and go to Advanced settings and choose "Restore defaults". Alternatively simply wait for the automatic upgrade which will change the settings for you automatically. Link to post Share on other sites More sharing options...
puff_m_d Posted July 8, 2015 ID:974991 Share Posted July 8, 2015 Hello Pedro, A quick question about the changing of the default setting for "Disable Internet Explorer VB Scripting":Is that the only change from 1010 to 1011?Is this considered a temporary fix for those that have experienced issues or is this going to be permanent default setting now?I am wondering if you have plans to fine tune this setting and re-enable it again in the future.I ask for those that have not had any issues with this setting being enabled and assume if we have had no issues with it that it would be good to enable this setting.Thanks ... Link to post Share on other sites More sharing options...
Staff pbust Posted July 9, 2015 Staff ID:975103 Share Posted July 9, 2015 There's a couple of new items in the changelog, namely the disabling of the vbscripting technique and an optimization for Chrome to solve some crash issues. This is temporarily while we finetune the technique. But feel free to enable it if you don't experience any issues or don't use IE. Link to post Share on other sites More sharing options...
puff_m_d Posted July 9, 2015 ID:975107 Share Posted July 9, 2015 Thanks Pedro!!! I thought that was the case from previous posts but wanted to clarify... Link to post Share on other sites More sharing options...
dprout69 Posted July 27, 2015 ID:979301 Share Posted July 27, 2015 If you go to any web page, right click anywhere and click properties Internet Explorer (and add-ons)Application HardeningAttempt to execute VBScript blockedC:\Windows\SysWOW64\vbscript.dll It then closes and reopens the page and you are never allowed to see properties Link to post Share on other sites More sharing options...
ky331 Posted July 27, 2015 ID:979308 Share Posted July 27, 2015 Close IE Open MBAESETTINGS tabclick ADVANCED settingsApplication Hardening tabUnder Browsers column, if the box for "Disable Internet Explorer VB Scripting" is checked, UNcheck it, and hit APPLY. That should "mitigate" the problem until they come up with an actual fix. Reopen IE to test. Link to post Share on other sites More sharing options...
dprout69 Posted July 27, 2015 ID:979354 Share Posted July 27, 2015 Workaround is successful... thanks. Link to post Share on other sites More sharing options...
ky331 Posted July 27, 2015 ID:979356 Share Posted July 27, 2015 This is a known issue... use of VB Script turned out to be more prevalent than MBAE realized. I believe it was supposed to be disabled by default, effective with build x.1011 (and later)... so I'm wondering why it was on for you in build x.1015 They're working on it, and will hopefully be able to fine-tune matters for a future release. Link to post Share on other sites More sharing options...
Recommended Posts