How to stop MBAE protection so I can test

[ExpertNovice]

 

I was (am?) planning on buying MBAE for our computers.  However, I have an issue and it seems the only way to test is to uninstall MBAE.  I'm hoping there is an alternate method.

System:
Windows 10 Pro 64 bit
IE11
MBAE premium but free trial 1.08.1.2572
Webroot Secure Anywhere 9.0.13.50
Emsisoft Internet Security 12.?   (released yesterday so it is up to date)

Issue.

Most MHT files result in "Internet Explorer has stopped working."  Perhaps MBAE is doing its job stopping an exploit, perhaps not.

Setup

Saved website, before and after MBAE installed.  When MBAE was installed it detected no exploits.  (I assume)

To determine if MBAE was causing the issue I logged in the admin account and "Stop protection" on MBAE.  Opened MHT files and most crashed IE11 including the one saved a few minutes earlier with MBAE in protection mode.  However, it seems MBAE is not stopped as it popped up with the messages.
"cmd is now protected"
"Internet Explorer (and add-ons) is now protected"

Went to stop MBAE again and only the "Start protection" link was active.

 

Logged back into user account received the message that MBAE was stopped.  So, I tested the MHT file again.  Crashed and MBAE stated CMD and IE were now protected.  MBAE was opened Second and the general tab says "stopped" in black on red.

So, how do I test to see what the issue is?  Exploit or bug?

Thanks,
Jim

[Rsullinger]

Hello Jim,

Just to be certain it is disabled when you hit the stop protection, can you go into the services menu of the computer and stop the Malwarebytes Anti-exploit Service. That service is what controls the protection and as long as that is stopped, the protection cannot start. That is the easiest way to stop MBAE without un-installing it. Also, since you are running the trial, you can go into the UI and disable the IE shield for the program. That will make it so MBAE is still loaded, but we won't protect IE so you can test. 

Edited October 24, 2016 by Rsullinger
changed a word.

[ExpertNovice]

Thanks for responding.

I don't think MBAE is the culprit.  Will verify after the trial is over.  MBAE will be uninstalled and more tests run.  If the issue remains I will order MBAE for several systems.

 

When I first saw the shields tab everything was greyed out and I assumed the trial version did not allow me to deactivate a shield.  <slaps forehead>

Logged as admin, deactivated Internet Explorer (and add-ons) iexplore.exe.  (Lock is open.)   Opened an MHT file and it crashed IE11.

Rebooted system and killed the two MBAE processes (32 bit and 64 bit).  The processes kept restarting even though the MBAE icon did not appear in the task tray.  Protection was active.

Next test.  The MHT file was opened immediately after killing both processes and IE11 crashed again.

For the record.  When I save webpages the saved file is always, er, nearly... well, usually reopened immediately after saving to verify the save.

At this time, most MHT files crash IE11.

Still, I'm thinking it has nothing to do with MBAE.

 

Again, thanks for the education.

[Rsullinger]

Hello ExpertNovice,

 

No problem! If anything there may be something not liking the drivers which sometimes happens. If you have any anti-virus, I would always recommend adding these just to be safe:

 

Please note that for 64bit installations, these files are located in Program Files (x86).

 

• C:\Program Files\Malwarebytes Anti-Exploit\mbae.exe
• C:\Program Files\Malwarebytes Anti-Exploit\mbae-svc.exe
• C:\Program Files\Malwarebytes Anti-Exploit\mbae-cli.exe

[John A]

Ron, how are these excluded processes added to the latest version of Defender - As excluded files or excluded processes?  If the latter, should the full path be entered manually or just the process name?

[Rsullinger]

The top top two are processes so it may be worth adding it under excluded processes. However, I would also put them in the excluded files portion since the scanner will still scan it. You should use the full path for this. I think defender you may not have to specify it but I would do it to be safe.