MBAE Blocking all Browsers

[Ndallas75002]

MBAE Version : 1.09.1.1261

Recently MBAE displayed an error message about running long after boot up on my Win10 Home desktop.  Today none of my browsers (IE11, Edge, Firefox, or Chrome - all latest versions) would not open unless MBAE program was shut down or the browser shield deactivated for each browser.   I uninstalled MBAM and MBAE from Control Panel and ran both MBAM and MBAE cleaner programs from your web pages.  After a reboot I deleted both file directories using file explorer before both programs were reinstalled with latest versions downloaded from your webpage.    The same issue was again seen in MBAE.

Files are attached.  

Malwarebytes Anti-Exploit.zip

Addition.txt

FRST.txt

[TheSeb]

Same to me!

 

[Wilpower]

Yup here too. Disable MBAE till I've had chance to research

[cowboyman]

Same here - Firefox and IE wont' open unless I disable MBAE.  Oddly, the one browser I refuse to use (Chrome) opens without an issue.  Once I disabled MBAE both Firefox and IE opened without a problem.  I've been a user/subscriber since the first MBAE build and, in fact, purchased the full/pro version right after it was offered, thinking this was going to be a great product.  No more.  After this problem developed (for, what is it now, the 4th, 5th, 10th time ?- I've lost count) I confirmed the issue was MBAE then immediately uninstalled it on all my computers that still have it - I've had to uninstall on my office PC because It no longer starts-up despite multiple efforts to remove and reinstall. I suppose the silver lining is that I knew what to do right away to get my browsers working because, of course, this has happened before and by now I know that the problem is MBAE.   Time to find another, more reliable product developed by a more capable company. You guys REALLY need to get it together because based on the conversations I've had with people like me, we've officially lost patience. For for those of you who choose to continue using this product - good luck; you'll need it.

[alhazred]

I can confirm I can also not open IE with MBAE 1.09.1.1261 enabled.

[AdvancedSetup]

What antivirus are you running? It looks like something may have been changed by Kaspersky recently as there are other reports of this.

Looking into it further

 

 

Edited November 26, 2016 by AdvancedSetup

[TheSeb]

Yes, I´m running Kaspersky Internet Security 17.0.0.611.

Turning off KIS with MBAE running did work.

I could open the Browser.

But I rather go without MBAE than KIS.

Edited November 26, 2016 by TheSeb

[neonsurfer]

I was experiencing the same issue with Chrome. I disabled MBAE. Launched Chrome and received a KIS notice for their add-in. Acknowledged the add-in. Closed Chrome. Enabled MBAE again. Launched Chrome successfully with both add-ins. Hope that helps.

[Wilpower]

9 hours ago, AdvancedSetup said:

What antivirus are you running? It looks like something may have been changed by Kaspersky recently as there are other reports of this.

Looking into it further

I'm running latest KIS. Received no KIS notice about any Add-in

9 hours ago, AdvancedSetup said:

 

 

 

[Ndallas75002]

I am running Kaspersky Internet Security, Version 17.0.0.611b.    This is not the first time for issues with Kasperksy and Malwarebytes.   Can't you work together with them to resolve this now and going forward?   

[alhazred]

I'm using Kaspersky Internet Security 17.0.0.611b.   It seems to be working okay now as I can launch IE with MBAE enabled.

[AdvancedSetup]

Please check for updates on Kaspersky and let us know if the issue remains.

Thanks

 

[Ndallas75002]

Ran the Kaspersky update this morning and reactivated the shields for all browsers.   Browsers are now opening again.  Thanks.

[nivrip]

I could not open IE11 but MS Edge was fine. There were issues with Gmail too - I could only open my mail in the old HTML version but not the Standard version. When I switched off Malwarebytes Exploit  IE11 and Gmail both returned to normal immediately. I also use the latest version of Kaspersky but that does not seem to cause any problems.

[Wilpower]

Well the issue on my machines running KIS 2017 appear to be resolved. MBAE enabled and Browsers working fine.

[alhazred]

Everything definitely working fine for me now.

[AdvancedSetup]

Thanks everyone, yes, it looks like Kaspersky made an update which corrected the issue.

Cheers

 

[Ndallas75002]

Well, it was working yesterday for all browsers but this morning none of my browsers will open again.  Latest Kaspersky updates have already been downloaded and installed.  If I exit from Kaspersky Internet Security all browsers will open normally.

[ProblemChild]

KIS 16.0.0.614(h)

MBAE 1.09.1.1261

Win 7 Pro 64

Regarding https://forums.malwarebytes.org/topic/191126-kaspersky-forum-mod-advises-uninstall-of-mbae/
C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae64.sys was specified.
Did anyone from Malwarebytes contact Kaspersky about this?

I was able to launch Firefox & Chrome 64 bit browsers this morning with MBAE running.
Several hours later back to the same problem with 64 bit browsers not launching.
Kaspersky auto updates every couple of hours.

[AdvancedSetup]

Unfortunately, we don't have a direct contact to support or programming within the Kaspersky company. We can only submit like you and review our own code to make sure but the main core of MBAE has not changed for a while now. I'll bring it up again with our team, but I would highly suggest you post your concerns on the Kaspersky forum as well, as it's really up to them to make the change since our product has not changed.

 

[musicrab]

I too can confirm I can also not open IE with MBAE 1.09.1.1261 enabled.   (since morning of 30th November , UK time).  Edge, Firefox, Chrome ok. With latest W10-64-bit and Kaspersky Internet Security.

[OpsCenter]

We are experiencing a similar problem with Internet Explorer 10 & 11 and MBAE.    In some cases, a reboot would resolve the problem.  It is not happening across all campuses or on all workstations.  I have not been able to duplicate the problem.  When Malwarebytes is removed from the workstation, the reported problems go away.  For the short term, I have been asked by my CTO to disable MBAE at the console, so I updated the Policy to excluded IE.  If this does not work, I will exclude Java from the MBAE protection.  This kind of defeats the purpose for MBAE.

We are also using System Center Endpoint Protection.  Last week (Friday through Monday), we experienced the grief of the MS definition patches causing workstations to lockup, but the problem went away after MS released updated definitions.  Despite successful removal of millions of pieces of malware, my organization is considering the removal of Malwarebytes from our workstations completely.

[AdvancedSetup]

@OpsCenter

Yes, understood, but from the same token, if you removed Kaspersky it would work as well. Kaspersky is the one that has changed their product settings, not us. We are investigating if there is something we can do on our end, but if you look at it from a technical standpoint your company is blaming the wrong program. If we were making changes then yes I could understand us possibly being the cause, but in this case we're not making changes, Kaspersky is.

Not wanting to point fingers or leave you in the middle, as said though, we're looking at it to see if there is something we can do on our end for an update to the program to work around the Kaspersky changes.

Thank you

 

 

[ProblemChild]

On 11/29/2016 at 8:46 PM, AdvancedSetup said:

Unfortunately, we don't have a direct contact to support or programming within the Kaspersky company. We can only submit like you and review our own code to make sure but the main core of MBAE has not changed for a while now. I'll bring it up again with our team, but I would highly suggest you post your concerns on the Kaspersky forum as well, as it's really up to them to make the change since our product has not changed.

 

Multiple Kaspersky forum threads have already been created about this issue with forum Mod recommending removal of MBAE.

Regarding "main core of MBAE has not changed for a while now", is it possible that Kaspersky recently found a vulnerability in  mbae64.sys?

Did anyone from Malwarebytes  submit a question on the Kaspersky forum questioning why mbae64.sys was specifically mentioned?

 

[OpsCenter]

22 hours ago, AdvancedSetup said:

@OpsCenter

Yes, understood, but from the same token, if you removed Kaspersky it would work as well. Kaspersky is the one that has changed their product settings, not us. We are investigating if there is something we can do on our end, but if you look at it from a technical standpoint your company is blaming the wrong program. If we were making changes then yes I could understand us possibly being the cause, but in this case we're not making changes, Kaspersky is.

Not wanting to point fingers or leave you in the middle, as said though, we're looking at it to see if there is something we can do on our end for an update to the program to work around the Kaspersky changes.

Thank you

 

 

Actually, I was not very clear.  :-)   We are not using Kaspersky. 

We are using Microsoft's System Center Endpoint Protection.   No one has shared a further report of the issue with Internet Explorer locking up, since we unchecked IE under the Anti-Exploit settings in our MBMC Policy.  I will give it a couple weeks, and try to re-enable IE to see if the problem comes back.  To add further confusion to the problem, it seems to happen most often when a Java-based IE 10/11 frontend is used to access our Oracle servers.  I have been using IE11 and MBAE, and I was not experiencing the problem on either my Win 7 or Win 10 workstations.