Zaffy Posted October 29, 2016 ID:1069096 Share Posted October 29, 2016 Opening Edge page displays for a couple of seconds then a red Malwarebytes Anti-Exploit Has Blocked An Exploit Attempt pops up. It says Protection Against OS Security Bypass. Exploit ROP gadget attack blocked. I am using the Bing browser but The Malwarebytes pop-up is still visible and will remain until I click close. I have tried running a Malwarebytes scan. N.B. I am rubbish at computers, so, please, no complex answers. Thanks Link to post Share on other sites More sharing options...
John A Posted October 30, 2016 ID:1069098 Share Posted October 30, 2016 Hi Zaffy Might be worth posting some more details initially: Does this happen when you first start Edge? If so what is your start page? Do you have any Edge Extensions installed? What antivirus and other security applications are installed? What Edition, Version, and OS Build is your Windows 10 (Start > Settings > System > About) Link to post Share on other sites More sharing options...
Zaffy Posted October 30, 2016 Author ID:1069102 Share Posted October 30, 2016 I think the opening page is MSN. It appears for a few seconds and then the Malwarebytes pop up appears and the page says problem loading. I received an email to say you had responded and I clicked the link and Edge took me to this site but then Malwarebytes popped up again and this page disappeared. So I am now on Chrome. I use Avast. Windows 10 Home. Version 1607. OS Build 14393.351. Not sure about extensions. Thanks Link to post Share on other sites More sharing options...
NeedToKnow Posted October 30, 2016 ID:1069106 Share Posted October 30, 2016 Having exactly the same problem with Windows 7 IE11 with Bing as home page. It happens on several sites that I have shortcuts to....even my bank (Canada). I went back to the previous version as the new one would not even let me attach this picture with out shutting ie down and displaying the notice attached. Link to post Share on other sites More sharing options...
John A Posted October 30, 2016 ID:1069107 Share Posted October 30, 2016 Thanks. Since there are at least three others with this issue, I suggest you also monitor progress the following thread. Malwarebytes staff will look at the logs supplied there and let you know if your logs are also required. Link to post Share on other sites More sharing options...
John A Posted October 30, 2016 ID:1069109 Share Posted October 30, 2016 So Windows 7 is also involved. Can you all attach your MBAE Logs and other information specified in this link for Malwarebytes staff to look at.https://forums.malwarebytes.org/topic/144403-readme-first-posts-here-need-to-include-mbae-logs/ The easiest way to zip the logs is to select all the files in the folder C:\ProgramData\Malwarebytes Anti-Exploit, right click > Send to > "Compressed (zipped) folder". Then attach the zip file to a reply here. Link to post Share on other sites More sharing options...
Zaffy Posted October 30, 2016 Author ID:1069143 Share Posted October 30, 2016 10 hours ago, John A said: So Windows 7 is also involved. Can you all attach your MBAE Logs and other information specified in this link for Malwarebytes staff to look at.https://forums.malwarebytes.org/topic/144403-readme-first-posts-here-need-to-include-mbae-logs/ The easiest way to zip the logs is to select all the files in the folder C:\ProgramData\Malwarebytes Anti-Exploit, right click > Send to > "Compressed (zipped) folder". Then attach the zip file to a reply here. Sorry, I do not understand the instructions. I clicked the Malwarebytes desktop icon and and clicked log but I do not know how to copy it. Where can I find folder C? Link to post Share on other sites More sharing options...
John A Posted October 30, 2016 ID:1069235 Share Posted October 30, 2016 Zaffy, there are plenty of others now who have submiited logs so don't worry about it unless a Malwarebytes staff member requests it. For future reference, you don't get at the logs via MBAE, you do the following: Open File Explorer Tick the View option to show "Hidden items" Navigate to the folder C:\ProgramData\Malwarebytes Anti-Exploit Select all the files in that folder (CTRL A) Right click on the selection area and choose Send to > "Compressed (zipped) folder" You will see a new folder appear that has an icon with a zipper on it Attach that file to a forum response here Meanwhile, do you have IBM Trusteer Rapport installed? It appears that this may be causing a conflict with MBAE. Link to post Share on other sites More sharing options...
Zaffy Posted October 30, 2016 Author ID:1069248 Share Posted October 30, 2016 John A, yes I have Trusteer installed. Link to post Share on other sites More sharing options...
John A Posted October 30, 2016 ID:1069252 Share Posted October 30, 2016 Interesting. Until Malwarebytes staff respond with a fix, you need to disable either Trusteer or MBAE Link to post Share on other sites More sharing options...
Zaffy Posted October 30, 2016 Author ID:1069257 Share Posted October 30, 2016 21 hours ago, John A said: John A, I have removed Malwarebytes. Edge working fine now. Thanks. Link to post Share on other sites More sharing options...
stevejc Posted October 31, 2016 ID:1069344 Share Posted October 31, 2016 I'm having exactly the same problem with Edge and also have Trusteer installed. I have had to disable Malwarebytes until a fix is available. Link to post Share on other sites More sharing options...
Staff Rsullinger Posted October 31, 2016 Staff ID:1069380 Share Posted October 31, 2016 Hello Everyone, If you have Trusteer and MBAE then please follow the instructions on our known issues and conflicts page: Trusteer Rapport may conflict with MBAE. As a workaround simply disable the ROP and malicious return address protections in MBAE's advanced settings to make Trusteer work alongside MBAE. Link to post Share on other sites More sharing options...
Staff Rsullinger Posted October 31, 2016 Staff ID:1069394 Share Posted October 31, 2016 Hello All, Along with what I mentioned in the last post, we will want to see those logs as well to confirm a few things on our side. If you can, please follow the instructions here to grab the logs: https://forums.malwarebytes.org/topic/144403-readme-first-posts-here-need-to-include-mbae-logs/ Link to post Share on other sites More sharing options...
stevejc Posted November 1, 2016 ID:1069485 Share Posted November 1, 2016 Attached are the logs you requested. mbae-service.zip FRST.txt Addition.txt Link to post Share on other sites More sharing options...
Staff Rsullinger Posted November 1, 2016 Staff ID:1069563 Share Posted November 1, 2016 Hey Stevejc, Perfect! Thank you for the logs. I am getting this over to our team to look at. Link to post Share on other sites More sharing options...
Zaffy Posted November 1, 2016 Author ID:1069624 Share Posted November 1, 2016 Logs attached. applications.zip Link to post Share on other sites More sharing options...
Staff Rsullinger Posted November 1, 2016 Staff ID:1069649 Share Posted November 1, 2016 Hello Everyone, If you are having the issue with IE and the ROP gadget detection's, please try rebooting the computers and see if you still have the issue. We pushed out something and we want to see if it fixes the issue for you. Please let me know if you still have the issue after that or confirm that it fixed it! Link to post Share on other sites More sharing options...
stevejc Posted November 2, 2016 ID:1069745 Share Posted November 2, 2016 Thanks for the efforts to fix this. Unfortunately I still do have the problem today after several reboots (if I return to the default settings). How would I know if I received whatever it was that you have pushed out - my version number is unchanged? Link to post Share on other sites More sharing options...
Staff Arthi Posted November 2, 2016 Staff ID:1069798 Share Posted November 2, 2016 Hello stevejc, We pushed out a change to our Advanced settings config wherein we disable the conflicting settings with Trusteer automatically, so that users can continue to use Edge with Trusteer. When you reboot your pc, you should see ROP and malicious return address detection settings disabled for Browsers. This is done temporarily until we provide a permanent fix. If you have disabled it manually, it is fine as well. Do not restore to default settings for now. For all other users, simply restart your pc for the settings change to take effect, after which you can continue using Edge browser without any blocks. Thanks for your patience. Link to post Share on other sites More sharing options...
RobbieBobbie Posted November 5, 2016 ID:1070535 Share Posted November 5, 2016 Still giving me grief. Assume these setting are correct. Link to post Share on other sites More sharing options...
Staff Arthi Posted November 6, 2016 Staff ID:1070655 Share Posted November 6, 2016 Hi RobbieBobbie, I am assuming you have Trusteer Rapport installed and MBAE triggers a block when you use Edge. If that is the case, restart your pc or you can manually uncheck CALL ROP Gadget detection (32 bit) for Browsers and CALL ROP Gadget detection (64 bit) for browsers and hit Apply. After you do this close and open your Edge browser again. Let us know if that works for you. Thanks. Link to post Share on other sites More sharing options...
RobbieBobbie Posted November 6, 2016 ID:1070710 Share Posted November 6, 2016 Hey Arthi. Both assumptions correct and temporary fix works like a charm.Thanks! Looking forward to a permanent resolution Link to post Share on other sites More sharing options...
stevejc Posted November 7, 2016 ID:1070799 Share Posted November 7, 2016 Something has changed again this morning and now Edge won't work at all if MBAE is active. Edge opens briefly, but even before my home page comes up it closes again without any error message. If I stop the MBAE protection Edge works fine again. I should add that I have my settings as per the manual work around described above but Edge is still not working now unless MBAE is fully stopped. Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now