Google Chrome block with new Trusteer Rapport

[Leonard]

Hi John,

It's Malwarebytes Anti-Exploit Premium.

Thanks.

[den6]

I have the same problem found that the conflict is Trusteer Endpoint Protection 3.5.1609.47 when I disable trusteer with anti exploit still on I can access Google Chrome. As soon as I activate Trusteer Rapport with Anti Exploit on it prevents me from opening Chrome. This started after Trusteer updated itself in the background. My solution is to turn off trusteer when using Chrome with anti exploit on. If using Banking (very rarely) to turn on Trusteer and turn off Anti exploit whilst doing so works , when finished to revert to anti exploit.

[hooperman]

Thanks pbust, I've been having the same problem. Your temporary fix worked for me. Look forward to seeing the solution.

[peterd]

I generally use Chrome browser.

This morning I cannot open chrome at all keep getting " Blocked malware attempt"

screen shot attached. Chrome version is 49.0.2623.110.

 

 

[MikeN]

My version of this problem is somewhat different from that which other people are experiencing.

 My desktopp is running Windows 10 64 bit (upgrade from Win7 Home 64 bit).

Yesterday (Wed) Chrome was fine EXCEPT if I tried to go into the Settings pages when MBAE immediately blocked me, with the same error message that others have posted, and closed Chrome down.

I found this forum and applied the recommended workaround in MBAE Advanced settings - it appeared to work.

Today (Thursday) Chrome started working fine but within an hour that was no longer the case and Chrome was being blocked totally by MBAE.

I completely uninstalled the Rapport extension from Chrome and Chrome then worked again but MBAE still blocked me from going into Chrome's Settings pages.

As Chrome is set up as I want it, it's unlikely that I will need to go into Settings terribly often and, if I do need to, I can simply right click on the MBAE icon in the Notification Area (if that's what MS are stilll calling it in 2016!) and select 'Stop Protection' while I review whichever Chrome settings I need to change, remembering, of course, to start protection again when I come out of Chrome's Settings page.

I still have Rapport installed in Firefox which I will now use for online banking while continuing with Chrome as my default browser.

So, it seems that the problem is not entirely about a conflict between MBAE and Rapport. There must be some other factor at work as well.

I suggest that those who have posted to say that they don't have a problem should try going into their Chrome 'Settings' pages and see if MBAE allows them in or not.

[rwmjlally]

As of this morning MBAE refuses to let Google Chrome run.

I assume either Chrome or MBAE have updated themselves since yesterday.

How can I tell if there is genuinely something wrong with Chrome or if it is just an incompatibility issue?

[RichardIrwin]

I have exactly the same problem.  Deleted Chrome and reinstalled and still have the same problem.

[RichardIrwin]

I have exactly the same problem. Have uninstalled Chrome, deleted all related files and reinstalled latest version.

[peterd]

I have same issue as others. Chrome was ok yesterday and couldn't get on it this morning. Running Chrome  49.0.2623.110  and MBAE  1.08.1. 1189. on Win10

Using Firefox to send this and no issues. No updates/ changes since last used that I know of.

[dcmargo54]

The very first time that Chrome crashed on me was after I went into, or tried to get into, the settings menu. That happened twice, but Chrome crashes whenever it tries to load now. Unchecking the previously referred to settings in the advanced menu in MBAE works to stop Chrome from crashing. Chrome still hasn't crashed on my HP machine. (Win 10, same apps as my ASUS Win 10 machine)

[scottorn]

FCA711 - The workaround worked! Huge thanks.

Does this expose us to hackers? I'm nervous about turning off any features.

[dcmargo54]

I can only assume that this issue will be addressed in due time. I'm not concerned myself, although I share your feelings about disabling any features in MBAE. Good security consists of a layered approach and I assume  you cover yourself appropriately. Firefox isn't affected as yet, so that's an option. I think of all the years that  I didn't use MBAE and take comfort in that. 

[peterd]

For what it's worth........ I'm no expert.

I think the problem is with Chrome & Rapport.  There was a similar issue a few months ago with these 2 but not involving MBAE.

I am using all the same security features on Firefox without any problem.  Chrome won't open at all now...... so solution for me use is Firefox.

[FCA711]

9 minutes ago, scottorn said:

FCA711 - The workaround worked! Huge thanks.

Does this expose us to hackers? I'm nervous about turning off any features.

That's my question as well.  I wish they would just come out with a fix and not require this workaround.  Turning off features is like punching holes in the security, so it's probably not ideal in the log run.

 

[dcmargo54]

The issue is with Rapport. If Rapport is stopped from running on my machine then all is well. But I'd rather keep Rapport running and uncheck a few options for Chrome in MBAE. I've had so many issues with Rapport since first adopting it that, more than once, I considered uninstalling it. But they've gotten a lot better over time and there are fewer and fewer issues, but this one is a pain, for sure. 

[JANW]

I have the same problem, I am using Chrome in windows 8.1 and Kaspersky internet security.  I have uninstalled chrome and anti exploit and reinstalled both but still have the same problem.  Have had to revert to using I.E.  If it cant be solved I will have to stop using anti exploit

[dcmargo54]

45 minutes ago, JANW said:

I have the same problem, I am using Chrome in windows 8.1 and Kaspersky internet security.  I have uninstalled chrome and anti exploit and reinstalled both but still have the same problem.  Have had to revert to using I.E.  If it cant be solved I will have to stop using anti exploit

There seems to be a conflict with Trusteer Rapport/Chrome/MBAE. This workaround seems to work for anyone that's tried it. There are three items in the advanced settings of MBAE that when unchecked will allow Chrome to run again normally. On the OS Bypass Protection tab in advanced settings, uncheck "Call ROP gadget detection (32 & 64 bit), and on the Advanced Memory Protection tab, uncheck Chrome Browsers. This should alleviate your problems.

[John L. Galt]

Everyone reading this thread and having issues with Chrome, Rapport and MBAE:

Please follow the instructions in this post by MB Staffer and developer Pedro (aka Pbust) to see if it resolves your issues:

 

[John L. Galt]

Are either of you using Rapport?  If so (IOW, if you use Chrome, Rapport and MBAE), then please see the following post:

@rwmjlally - If you are not using Trusteer Rapport, then please post back.

@RichardIrwin - If you are not using Trusteer Rapport, please start a separate topic of your own so that we may assist you with your problem individually.

[John L. Galt]

@peterd - Are you using Trusteer Rapport?  If so (IOW, if you use Chrome, Rapport and MBAE), then please see the following post:

If you are not using Trusteer Rapport, then please post back.

@RichardIrwin - I replied to you in another thread.

[John L. Galt]

Hey, @Leonard, thanks for the reply.

Are you using Trusteer Rapport?  If so (IOW, if you use Chrome, Rapport and MBAE), then please see the following post:

If you are not using Trusteer Rapport, then please post back.

Sorry about the 20 questions, but most reports of Chrome and MBAE having bad interactions are due to Trusteer.  I'm trying to isolate those people who do not have Trusteer installed and are still having issues with Chrome.

[Leonard]

Cheers John. Yes. I've got Trusteer running too. And hey! Here's the rub...Chrome is running today. 

[peterd]

On 06/04/2016 at 10:07 AM, pbust said:

 

I had to do both of the workarounds:

MBAE -> Settings -> Advanced Settings -> OS Bypass Protection -> CALL ROP gadget protection (32/64) -> uncheck for Chrome -> Apply

MBAE -> Settings -> Advanced Settings -> Advanced Memory Protection -> Malicious return address detection -> uncheck for Chrome -> Apply   THEN  REBOOT.

which seems to work o.k.

 

[John L. Galt]

New version of Chrome just came out.  Might have to do with that.

Did you by chance use the fixes from the post I referred to?  If not, please let us know so I can start getting other users to re-enable those setting sand see if it works on their end as well.

Also, if you would not mind, can you give us the versions of Chrome, Trusteer Rapport and MBAE that you're using?

[John L. Galt]

Another user has just posted that it started working again today.  I'm gathering details to see what versions of MBAE, Chrome and Rapport are being used.  I'll post back in a bit.