puff_m_d Posted November 13, 2015 ID:1001561 Share Posted November 13, 2015 Hello, I just updated to Windows 10 Pro 64 bit Version 1511 (OS Build 10586.3) and cannot launch any browser.When launching Chrome, I get the following message:When launching Edge, I get the following message:When launching IE11, I do not get any message from MBAE, but IE11 will not launch.The only thing that was changed on my system was the OS upgrade. All was working fine with the previous Windows version.I did try uninstalling MBAE and deleting the program data folder, followed by a reboot and a fresh install of MBAE but the issues remain.Attached you will find my MBAE logs.Thanks in advance for your help in investigating these issues...If you need any other information, please ask and I will supply it.Malwarebytes Anti-Exploit.7z Link to post Share on other sites More sharing options...
shukla44 Posted November 13, 2015 ID:1001569 Share Posted November 13, 2015 Hello, I started using MBAE free version recently. I had no conflicts or errors with it at start, but i found one.Whenever my firefox is running and i try to stop the MBAE protection, firefox crashes & MBAE gives a exploit blocked notification (see the attached image) even if i was on a blank page. This happens everytime with firefox only. No problems with chrome or IE 11. I tried using MBAE with a fresh Firefox profile, no error or exploit. I can't reset my profile & start from scratch so I uninstalled MBAE free version for now. I have attached the MB logs. See if you can determine what is the exact conflict so i can fix it and use it with my current FF profile. And also, if you guys need any more info or logs, i can provide them. Regards.MBAE.rar Link to post Share on other sites More sharing options...
shukla44 Posted November 13, 2015 ID:1001573 Share Posted November 13, 2015 Sorry forgot to mention in my previous post. I was using the latest version of MBAE Free & Firefox 42 & Windows 7 Ultimate 64-bit. Link to post Share on other sites More sharing options...
Staff pbust Posted November 14, 2015 Staff ID:1001654 Share Posted November 14, 2015 Thanks for reporting Kent. Can you please also attach or PM me your FRST logs? Thanks! Link to post Share on other sites More sharing options...
Staff pbust Posted November 14, 2015 Staff ID:1001655 Share Posted November 14, 2015 Thanks for reporting. Can you please also attach or PM me your FRST logs? Thanks! Link to post Share on other sites More sharing options...
puff_m_d Posted November 14, 2015 Author ID:1001659 Share Posted November 14, 2015 Hello Pedro, Thanks for the prompt reply... I will get the FRST logs to you sometime over the weekend (probably by attaching to a PM with reference to this thread). I just finished getting my systems updated to the new Windows 10 build but still have to optimize the systems and create new system image backups before I do anything else. As soon as I finish those tasks, I will get those logs created and sent to you. Link to post Share on other sites More sharing options...
shukla44 Posted November 14, 2015 ID:1001683 Share Posted November 14, 2015 Hello, I PM you the requested logs. Link to post Share on other sites More sharing options...
puff_m_d Posted November 15, 2015 Author ID:1001854 Share Posted November 15, 2015 Hello Pedro, Update:The issues I reported persisted for 3 days, however, upon booting my system this morning, all is now working as previously. I can launch all three mentioned browsers successfully without any issues. The only things that have been done on the affected systems was running disk cleanup to remove the ~ 14 GB of files related to installing the 1511 update, doing a defrag, and then making an image (backup) of the new system. The issues have just disappeared and all is once again working well. I have no clue as to what has changed and why the issues no longer exist. I see no reason to create and send you the logs from FRST but if you would still like them even tho the issue is fixed, I can still create and send them. I have updated software and done a few reboots this morning and the issues have not returned, so you may close this thread as solved. Thanks again for your help. Link to post Share on other sites More sharing options...
Wilpower Posted November 15, 2015 ID:1001860 Share Posted November 15, 2015 Yes just fyi, no issues here on "latest" Win10 64Bit and MBAE Premium "latest" version. Link to post Share on other sites More sharing options...
Staff pbust Posted November 16, 2015 Staff ID:1001985 Share Posted November 16, 2015 Thanks for the logs! Please deactivate the RET ROP gadget detection techniques under Advanced settings -> OS Bypass Protection. We're seeing some FP conditions with this technique and need to finetune it. Link to post Share on other sites More sharing options...
Staff pbust Posted November 16, 2015 Staff ID:1001987 Share Posted November 16, 2015 There's some FPs we're seeing with the RET-ROP gadget detection techniques. If you run across these problems again, disable these techniques and let me know if the problems continue. Link to post Share on other sites More sharing options...
puff_m_d Posted November 16, 2015 Author ID:1001990 Share Posted November 16, 2015 Hello Pedro, Thanks for the reply. If I encounter these issues again, I will let you know. All has been problem free for the last 2 days. Link to post Share on other sites More sharing options...
shukla44 Posted November 18, 2015 ID:1002337 Share Posted November 18, 2015 For now, I have MBAE uninstalled, will install it & check your solution and get back to you as soon as i can. Regards. Link to post Share on other sites More sharing options...
puff_m_d Posted November 20, 2015 Author ID:1002697 Share Posted November 20, 2015 Hello Pedro, There's some FPs we're seeing with the RET-ROP gadget detection techniques. If you run across these problems again, disable these techniques and let me know if the problems continue. The issue appeared out of the blue again today. When it happened, I decided to reboot my system to see if that had any effect. After the reboot, the issue was gone and all was working as it should. I do not know if this helps you but thought I would mention it just in case. Link to post Share on other sites More sharing options...
Staff pbust Posted November 20, 2015 Staff ID:1002700 Share Posted November 20, 2015 The issue appeared out of the blue again today. When it happened, I decided to reboot my system to see if that had any effect. After the reboot, the issue was gone and all was working as it should. I do not know if this helps you but thought I would mention it just in case. Did you disable the RET-ROP techniques like I mentioned above? Link to post Share on other sites More sharing options...
puff_m_d Posted November 20, 2015 Author ID:1002702 Share Posted November 20, 2015 Hello Pedro, No, I did not. The issue just reappeared after a week of working fine. The reboot fixed the issue for whatever reason without disabling the RET-ROP techniques that you mentioned. Since the Windows 1511 update, I have had this issue twice and both times it seems a reboot fixes it without disabling those techniques. Link to post Share on other sites More sharing options...
Staff pbust Posted November 20, 2015 Staff ID:1002704 Share Posted November 20, 2015 They'll probably come back eventually if you don't disable it. We're working on a FP-control mechanism for this new technique. Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now