Jump to content

Google Chrome block with new Trusteer Rapport


Recommended Posts

I Have down loaded and run your 1195 build update and rebooted. MBAE is now not loading, just returning the following error.

 I think my 1194 build of mbae had been running as 64 bit?

So I've now not got any mbae protection (but can get onto Google Chrome!!!)

any solutions appreciated.

Win7 Pro 64bit, Avast IS 2016 (with MBAE and MBAM exclusions set), Trusteer Rapport) Google Chrome, Firefox.

Link to post
Share on other sites
  • Replies 283
  • Created
  • Last Reply

Top Posters In This Topic

Until ten days or so ago I was able to use Google Chrome as my main browser. When I am running Malwarebytes Anti-Exploit, it blocks all URLS when I use Google Chrome.  This doesn't happen with the latest version if Firefox or IE.  Anyone any ideas how to cure this problem?  I am using Windows 10 and Norton Internet Security, both fully updated.

JohnWiltshireUK

Link to post
Share on other sites

Hi, @JohnWiltshireUK, and :welcome:

Are you by chance using Trusteer Rapport?  If so, please see this topic:

Specifically, see this post for an alternate build that should fix the issue: 

 

If you are not using Trusteer Rapport, please post back so we can diagnose your issue separately from that thread.

Link to post
Share on other sites

royg,

What might have happened in your case is that you ended up with a more recent version of Chrome after you re-installed, and that would definitely change the situation.

Rapport is an integral art of the problem, and in the current version of Chrome ( 50.0.2661.75 m ) Rapport doesn't work.

Link to post
Share on other sites

I had trouble with Trusteer Rapport, so I downloaded build 1195. That seemed to fix the issue in Chrome, Rapport worked. Everything seemed normal, but now I have a new problem. Every time I try to print within Chrome, Anti-Exploit closes ALL Chrome windows and gives me a warning. "An exploit code has been blocked in Google Chrome (and plug-ins)."  I never see the Print dialog box. 

This only happens in Chrome. I can successfully print within other browsers (Edge, IE, and FIrefox).  

Using Windows 10, Google Chrome Version 49.0.2623.112 m, and Malwarebytes Anti-Exploit Free 1.08.1.1195

IBM Security Trusteer Rapport Version: Emerald Build 1609.47

Link to post
Share on other sites

The problem is sort of fixed.  I reinstalled MBAE and it was working alongside Chrome with Rapport.  However if I clicked a download link or tried to print from the webpage Chrome just shut itself down without any message.

 

Link to post
Share on other sites

Rapport is now working with Chrome V50, but the same problem with MBAE still exists as before. when the relevent boxes below are unticked

Chrome can be used. So please MBAE now Rapport and Chrome have sorted themselves out, can get a fix.

MBAE -> Settings -> Advanced Settings -> OS Bypass Protection -> CALL ROP gadget protection (32/64) -> uncheck for Chrome -> Apply

 

MBAE -> Settings -> Advanced Settings -> Advanced Memory Protection -> Malicious return address detection -> uncheck for Chrome -> Apply

Link to post
Share on other sites

Right now Chrome is running fine with MBAE, free version .1195 and Rapport enabled once more. I noticed that Chrome updated to v50.0.2661.87 and Rapport is still at v609.47, so I'm guessing it was the Crome update that allowed Rapport to work in the browser again. I had a few instances where Google Inbox wouldn't load properly, but upon reboot, everything seems to be OK.

Link to post
Share on other sites

I keep getting a notification that MBAE has blocked an exploit attempt when I enter Google Chrome. I've removed and re-installed both MBAE and Chrome but this thing keeps returning. Scans by various security programs such as MBAW, Anti rootkit, Windows Defender, Hitman Pro and Adware all tell me I have no infection so why does this keep popping up and closing down Google Chrome and how can I stop it?

Link to post
Share on other sites
25 minutes ago, Dragonfly said:

I keep getting a notification that MBAE has blocked an exploit attempt when I enter Google Chrome. I've removed and re-installed both MBAE and Chrome but this thing keeps returning. Scans by various security programs such as MBAW, Anti rootkit, Windows Defender, Hitman Pro and Adware all tell me I have no infection so why does this keep popping up and closing down Google Chrome and how can I stop it?

Hi:

The behavior you describe sounds similar to that reported here:

and here:

You might want to try updating to the current BETA build (1195), as explained here:

Note: if you use NoScript browser extension, you'll need to allow "box.com" and "boxcdn.net" in order to download the installer from that special link.

Please let us know if that resolves your issue.

Thanks.

P.S. The forum staff might move this thread or merge it with the existing topics in the MBAE Support forum.  No worries, though.;)

Edited by daledoc1
fixed link
Link to post
Share on other sites

I am running Google Chrome  Version 50.0.2661.87 m (64-bit)  and MBAE vs. 1.08.1.1195.

Yesterday evening 24/04/16 I noticed that Chrome was not loading, It was OK the day before (and possibly earlier the same day) but I am not sure on what versions as both are set to update automatically.

I have de-installed and re-installed both Chrome and MBAE (MBAE using the full de-install - switch-off MBAE, reboot, un-install, reboot, delete the two directories, reboot, re-install).

Chrome now only loads if MBAE is switched off.

However, if MBAE is switched ON Chrome does load if I launch it from the Desktop with 'Run Outside Sandbox' - what-ever that means.

I am running Avast security.

Any ideas ?

Thanks

Link to post
Share on other sites

Ignore the comment ", However, if MBAE is switched ON Chrome does load if I launch it from the Desktop with 'Run Outside Sandbox' - what-ever that means." I have not been able to repeat this.

Chrome only loads if MBAE is switched off.

 

 

Link to post
Share on other sites

Hi, @Chippers, and :welcome:

I see that you have build 1195, which was a fix build released specifically for fixing issues with folks running Chrome, Anti-Exploit, and Trusteer Rapport.  I just want to verify - are you running Rapport or not?  And when running Chrome normally (not outside sandbox) with Anti-Exploit running, do you get any error message or dialog box to pop up?

Link to post
Share on other sites
On 22/04/2016 at 8:25 PM, garbon said:

Rapport is now working with Chrome V50, but the same problem with MBAE still exists as before. when the relevent boxes below are unticked

Chrome can be used. So please MBAE now Rapport and Chrome have sorted themselves out, can get a fix.

MBAE -> Settings -> Advanced Settings -> OS Bypass Protection -> CALL ROP gadget protection (32/64) -> uncheck for Chrome -> Apply

 

MBAE -> Settings -> Advanced Settings -> Advanced Memory Protection -> Malicious return address detection -> uncheck for Chrome -> Apply

I would like to endorse all of that. With Chrome 49 + Rapport, the only ill effect I noticed with MBAE 1195 on its default settings was that it prevented me from running a downloaded executable file by double-clicking on its tab at the bottom of the Chrome window. But with Chrome 50 and the version of Rapport updated to work with it, I find that attempting to load a complex web page will sometimes result in hanging (though trying to load the same page again will often work). So I've now once more unchecked those two MBAE settings in the hope that that will fic it. 

Link to post
Share on other sites

John, Thanks for the pointer.  I have now downloaded and reloaded MBAE vs 1189 and Chrome now works OK. I presumed that 1195 was the latest version.

However, to answer your questions, no - I am not running Rapport.

The Sandbox referred to is the Avast Sandbox, according to Avast the 'sandbox allows you to run potentially suspicious applications in a completely isolated environment'. Normally I would run Chrome outside of the Avast Sandbox. Using 1189 I have now run Chrome both outside and inside the Sandbox, both 'loads' were recorded on the MBAE log. (Interesting that MBAE outside the Sandbox could see Chrome inside - but that's a different issue).

When I had the problem with 1195 there was no error message nor dialog box, some-times all that happened was the little blue wheel span around for ages and then stopped with no Chrome window, other times it got to the point of being able to enter a search and then getting search results but selecting a result got another spinning wheel and after a time the Chrome window would disappear.

Now that I know the fix I can reload 1195 and experiment if it serves any purpose.

Thanks for your help.

Link to post
Share on other sites

Right on.  Build 1189 is still the official build, and that one has been out for a while.  I suspect that some of the fixes in 1195 that were Chrome and Trusteer specific are not ready fo general consumption yet, particularly by users who do not user Rapport.

Since 1189 works perfectly fine for you, I'd stick with that.  Just be sure to report back if it starts acting wonky again.

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    No registered users viewing this page.


Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.