Jump to content
trevoralf

MBAE suddenly blocking every protected application

Recommended Posts

Hi, We've got a couple of machines here where AE is suddenly blocking every protected application including Word, Excel, Powerpoint and Adobe Reader (Exploit shellcode copied to memory blocked ).   Both are Windows 10 with Adobe 10, different versions of Office (2007\2010) and have McAfee VSE and HIPS running, but there's nothing particularly unusual to them compared to the couple hundred other machines running similar software.

The machines were running AE 1.09.1.1266, so we've manually upgraded them to 1.09.2.1291 but are still getting the same problem.

As anyone got any ideas what may be going on?  

Share this post


Link to post
Share on other sites

Further details - we've uninstalled the client, MB and AE via the console and tried reinstalling.  This has reinstalled AE 1.08.2.1189 which stills gives the same problem.  It also is refusing to install MB.  We've tried via the console and via a package but, although the install appears to go correctly, MB doesn't get installed (although a MB folder appears in Program Data with the rules etc within it).  

We've then tried uninstalling everything, manually deleting MB related folders in Program Files and Program Data and the sccomm folder, running the mbam clean managed exe and MB still won't install (and AE still blocks eveything).

Share this post


Link to post
Share on other sites

I've sorted the MBAM install issue, so i'm just left with multiple versions of AE blocking every protected application now.

(P.S. Is it possible to edit my own posts, rather than keep replying to myself?)

Share this post


Link to post
Share on other sites

Hello Trevoralf,

 

I am going to send you a PM with some logging I want you to collect. Just want you to send me the logs through the PM and we can continue the discussion here.

 

As for editing your post, there should be an edit button toward the bottom of the post. 

Share this post


Link to post
Share on other sites

I've resolved the AM install issue.  The debug version of AE that you've provided doesn't display the same problem so we're going to put the original version back on to see what happens and i'll post back.

Share this post


Link to post
Share on other sites

Hey Trevoralf,

 

No problem. Let me know if after installing it again, it returns. 

Edited by Rsullinger

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.