Jump to content

How to stop MBAE protection so I can test


ExpertNovice
 Share

Recommended Posts

 

I was (am?) planning on buying MBAE for our computers.  However, I have an issue and it seems the only way to test is to uninstall MBAE.  I'm hoping there is an alternate method.

System:
Windows 10 Pro 64 bit
IE11
MBAE premium but free trial 1.08.1.2572
Webroot Secure Anywhere 9.0.13.50
Emsisoft Internet Security 12.?   (released yesterday so it is up to date)

Issue.

Most MHT files result in "Internet Explorer has stopped working."  Perhaps MBAE is doing its job stopping an exploit, perhaps not.

Setup

Saved website, before and after MBAE installed.  When MBAE was installed it detected no exploits.  (I assume)

To determine if MBAE was causing the issue I logged in the admin account and "Stop protection" on MBAE.  Opened MHT files and most crashed IE11 including the one saved a few minutes earlier with MBAE in protection mode.  However, it seems MBAE is not stopped as it popped up with the messages.
"cmd is now protected"
"Internet Explorer (and add-ons) is now protected"

Went to stop MBAE again and only the "Start protection" link was active.

 

Logged back into user account received the message that MBAE was stopped.  So, I tested the MHT file again.  Crashed and MBAE stated CMD and IE were now protected.  MBAE was opened Second and the general tab says "stopped" in black on red.

So, how do I test to see what the issue is?  Exploit or bug?

Thanks,
Jim

Link to post
Share on other sites

  • Staff

Hello Jim,

Just to be certain it is disabled when you hit the stop protection, can you go into the services menu of the computer and stop the Malwarebytes Anti-exploit Service. That service is what controls the protection and as long as that is stopped, the protection cannot start. That is the easiest way to stop MBAE without un-installing it. Also, since you are running the trial, you can go into the UI and disable the IE shield for the program. That will make it so MBAE is still loaded, but we won't protect IE so you can test. 

Edited by Rsullinger
changed a word.
Link to post
Share on other sites

Thanks for responding.

I don't think MBAE is the culprit.  Will verify after the trial is over.  MBAE will be uninstalled and more tests run.  If the issue remains I will order MBAE for several systems.

 

When I first saw the shields tab everything was greyed out and I assumed the trial version did not allow me to deactivate a shield.  <slaps forehead>

Logged as admin, deactivated Internet Explorer (and add-ons) iexplore.exe.  (Lock is open.)   Opened an MHT file and it crashed IE11.


Rebooted system and killed the two MBAE processes (32 bit and 64 bit).  The processes kept restarting even though the MBAE icon did not appear in the task tray.  Protection was active.

Next test.  The MHT file was opened immediately after killing both processes and IE11 crashed again.

For the record.  When I save webpages the saved file is always, er, nearly... well, usually reopened immediately after saving to verify the save.

At this time, most MHT files crash IE11.

Still, I'm thinking it has nothing to do with MBAE.

 

Again, thanks for the education.

Link to post
Share on other sites

  • Staff

Hello ExpertNovice,

 

No problem! If anything there may be something not liking the drivers which sometimes happens. If you have any anti-virus, I would always recommend adding these just to be safe:

 

Please note that for 64bit installations, these files are located in Program Files (x86).

 

  • C:\Program Files\Malwarebytes Anti-Exploit\mbae.exe
  • C:\Program Files\Malwarebytes Anti-Exploit\mbae-svc.exe
  • C:\Program Files\Malwarebytes Anti-Exploit\mbae-cli.exe
Link to post
Share on other sites

  • Staff

The top top two are processes so it may be worth adding it under excluded processes. However, I would also put them in the excluded files portion since the scanner will still scan it. You should use the full path for this. I think defender you may not have to specify it but I would do it to be safe. 

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share

  • Recently Browsing   0 members

    No registered users viewing this page.

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.