ExpertNovice Posted October 21, 2016 ID:1067749 Share Posted October 21, 2016 I was (am?) planning on buying MBAE for our computers. However, I have an issue and it seems the only way to test is to uninstall MBAE. I'm hoping there is an alternate method. System: Windows 10 Pro 64 bit IE11 MBAE premium but free trial 1.08.1.2572 Webroot Secure Anywhere 9.0.13.50 Emsisoft Internet Security 12.? (released yesterday so it is up to date) Issue. Most MHT files result in "Internet Explorer has stopped working." Perhaps MBAE is doing its job stopping an exploit, perhaps not. Setup Saved website, before and after MBAE installed. When MBAE was installed it detected no exploits. (I assume) To determine if MBAE was causing the issue I logged in the admin account and "Stop protection" on MBAE. Opened MHT files and most crashed IE11 including the one saved a few minutes earlier with MBAE in protection mode. However, it seems MBAE is not stopped as it popped up with the messages. "cmd is now protected" "Internet Explorer (and add-ons) is now protected" Went to stop MBAE again and only the "Start protection" link was active. Logged back into user account received the message that MBAE was stopped. So, I tested the MHT file again. Crashed and MBAE stated CMD and IE were now protected. MBAE was opened Second and the general tab says "stopped" in black on red. So, how do I test to see what the issue is? Exploit or bug? Thanks, Jim Link to post Share on other sites More sharing options...
Staff Rsullinger Posted October 24, 2016 Staff ID:1068101 Share Posted October 24, 2016 (edited) Hello Jim, Just to be certain it is disabled when you hit the stop protection, can you go into the services menu of the computer and stop the Malwarebytes Anti-exploit Service. That service is what controls the protection and as long as that is stopped, the protection cannot start. That is the easiest way to stop MBAE without un-installing it. Also, since you are running the trial, you can go into the UI and disable the IE shield for the program. That will make it so MBAE is still loaded, but we won't protect IE so you can test. Edited October 24, 2016 by Rsullinger changed a word. Link to post Share on other sites More sharing options...
ExpertNovice Posted October 25, 2016 Author ID:1068185 Share Posted October 25, 2016 Thanks for responding. I don't think MBAE is the culprit. Will verify after the trial is over. MBAE will be uninstalled and more tests run. If the issue remains I will order MBAE for several systems. When I first saw the shields tab everything was greyed out and I assumed the trial version did not allow me to deactivate a shield. <slaps forehead> Logged as admin, deactivated Internet Explorer (and add-ons) iexplore.exe. (Lock is open.) Opened an MHT file and it crashed IE11. Rebooted system and killed the two MBAE processes (32 bit and 64 bit). The processes kept restarting even though the MBAE icon did not appear in the task tray. Protection was active. Next test. The MHT file was opened immediately after killing both processes and IE11 crashed again. For the record. When I save webpages the saved file is always, er, nearly... well, usually reopened immediately after saving to verify the save. At this time, most MHT files crash IE11. Still, I'm thinking it has nothing to do with MBAE. Again, thanks for the education. Link to post Share on other sites More sharing options...
Staff Rsullinger Posted October 25, 2016 Staff ID:1068305 Share Posted October 25, 2016 Hello ExpertNovice, No problem! If anything there may be something not liking the drivers which sometimes happens. If you have any anti-virus, I would always recommend adding these just to be safe: Please note that for 64bit installations, these files are located in Program Files (x86). C:\Program Files\Malwarebytes Anti-Exploit\mbae.exe C:\Program Files\Malwarebytes Anti-Exploit\mbae-svc.exe C:\Program Files\Malwarebytes Anti-Exploit\mbae-cli.exe Link to post Share on other sites More sharing options...
John A Posted October 29, 2016 ID:1068967 Share Posted October 29, 2016 Ron, how are these excluded processes added to the latest version of Defender - As excluded files or excluded processes? If the latter, should the full path be entered manually or just the process name? Link to post Share on other sites More sharing options...
Staff Rsullinger Posted October 31, 2016 Staff ID:1069366 Share Posted October 31, 2016 The top top two are processes so it may be worth adding it under excluded processes. However, I would also put them in the excluded files portion since the scanner will still scan it. You should use the full path for this. I think defender you may not have to specify it but I would do it to be safe. Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now