Jump to content

Mavwarebytes 3 - Exploit protection prevents IE launching


Recommended Posts

I've come across an issue where Internet explorer will not successfully launch with "Exploit protection" from MB 3.0 premium enabled.

When you attempt to launch IE, you receive a whirly mouse pointer for a couple of seconds before IE crashes. You never see any sign of IE visibly launching on the display.

I mainly use Firefox for browsing, so this is a minor issue with me, I do not need assistance further diagnosing this, but am posting this information to help improve the product and assist others.

I have identified a workaround, which is to disable "Exploit protection" for Internet Explorer (only) - Of course disabling a protection method for one of the applications which it is most important to protect is far from ideal (but in my case acceptable as I only use IE for a few sites that I trust). (The setting is found under Settings => Protection => (Under Exploit Protection) "Manage Protected Applications" => Turn off "Internet Explorer (and add ins)"

x64

 

Relevant information:

Malwarebytes 3.0.4.1269 - Premium (with lifetime license)
Windows 10 Professional 64 bit. - v 1607 English International (EN-GB), updated to include December 2016 patch Tuesday.
Kaspersky Total Security 2017 17.0.0.611(C) - All modules in use except "Safe Money"

When IE crashes, the following event is logged:

Log Name:      Application
Source:        Application Error
Date:          15/12/2016 19:14:32
Event ID:      1000
Task Category: (100)
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      (redacted)
Description:
Faulting application name: iexplore.exe, version: 11.0.14393.0, time stamp: 0x57899953
Faulting module name: ntdll.dll, version: 10.0.14393.479, time stamp: 0x5825887f
Exception code: 0xc0000005
Fault offset: 0x0000000000075dd0
Faulting process ID: 0x27e0
Faulting application start time: 0x01d257077752078e
Faulting application path: C:\Program Files\Internet Explorer\iexplore.exe
Faulting module path: C:\WINDOWS\SYSTEM32\ntdll.dll
Report ID: 6f2aa6f2-5efa-438c-b245-12bce2c0670e
Faulting package full name:
Faulting package-relative application ID:


Troubleshooting so far:
Disabling all MB protection methods allowed IE to run.
Narrowed that down to all protection methods running except "Exploit protection" - IE runs OK
Re-enabled "Exploit protection" - IE Fails to launch.
Under "Exploit protection", In "Manage Protected applications" disabled "Internet Explorer (and add ins)" - IE runs OK     
Re-enabled that setting - IE Fails to launch.
Under "Exploit protection", In "Advanced Settings" disabled all protections in all categories. - IE Fails to launch.
In those "Advanced Settings", Restored the default protections. - IE Fails to launch.

Disabled Kaspersky setting to force its protection extensions into browsers
Accessing IE "Manage Add-ons" settings, disabled all extensions - IE Fails to launch.
(note: in the above I disabled "Exploit protection" in order to access the "Manage Add-ons" form, then re-enabled it for the test.
Re-enabled Kaspersky forcing its protection extensions into browsers
Re-enabled IE add ins.

Comment: Three changes occurred to system in a relatively short time (Upgrade to MB 3.0, KTS 2017 patch C and the December Windows Updates), I only noticed the issue after all three and so cannot say if the Windows or KTS updates are implicated. I was not running Anti-Exploit before MB 3.0.

Additional issue:  the "Manage Protected Applications" seems a bit screwy... This morning I had three "Internet Explorer (and add ins)" items in the list, only one of which could be managed. This evening I have only one again (but sometimes activating the switch has no visible effect but does appear to actually change the setting)

 

 

 

 

Link to post
Share on other sites

  • Staff

Hello, x64--

This is due to a known conflict with Kaspersky:

We're working on integrating the fix that has already been tested in the standalone beta MBAE.  In the meantime, the temporary work-around would be to go to Settings > Protection > Real-Time Protection > Manage Protected Applications and then turn off protection for any browsers you use (just as you discovered works).

We hope to have an upgrade out shortly that address this.

Link to post
Share on other sites

Thanks for the very quick response.

It might be worth updating the Malwarebytes 3.0 known issues list with this and any other MBAE issues that are 'grandfathered' into Malwarebytes 3 (or linking to the MBAE known issues list if that accurately describes issues garndfathered into the combined product. I checked only the "Malwarebytes 3" list before posting.

Also note that I mentioned another (very minor issue) and included a typo (omitted a word) in my report

Additional issue:  the "Manage Protected Applications" dialog seems a bit screwy... This morning I had three "Internet Explorer (and add ins)" items in the list, only one of which could be managed. This evening I have only one again (but sometimes activating the switch has no visible effect but does appear to actually change the setting)

Again no panic from my point of view... Just another minor issue to be aware of.

x64

 

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share

  • Recently Browsing   0 members

    No registered users viewing this page.

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.