MBAE suddenly blocking every protected application

[trevoralf]

Hi, We've got a couple of machines here where AE is suddenly blocking every protected application including Word, Excel, Powerpoint and Adobe Reader (Exploit shellcode copied to memory blocked ).   Both are Windows 10 with Adobe 10, different versions of Office (2007\2010) and have McAfee VSE and HIPS running, but there's nothing particularly unusual to them compared to the couple hundred other machines running similar software.

The machines were running AE 1.09.1.1266, so we've manually upgraded them to 1.09.2.1291 but are still getting the same problem.

As anyone got any ideas what may be going on?  

[trevoralf]

Further details - we've uninstalled the client, MB and AE via the console and tried reinstalling.  This has reinstalled AE 1.08.2.1189 which stills gives the same problem.  It also is refusing to install MB.  We've tried via the console and via a package but, although the install appears to go correctly, MB doesn't get installed (although a MB folder appears in Program Data with the rules etc within it).  

We've then tried uninstalling everything, manually deleting MB related folders in Program Files and Program Data and the sccomm folder, running the mbam clean managed exe and MB still won't install (and AE still blocks eveything).

[trevoralf]

I've sorted the MBAM install issue, so i'm just left with multiple versions of AE blocking every protected application now.

(P.S. Is it possible to edit my own posts, rather than keep replying to myself?)

[Rsullinger]

Hello Trevoralf,

 

I am going to send you a PM with some logging I want you to collect. Just want you to send me the logs through the PM and we can continue the discussion here.

 

As for editing your post, there should be an edit button toward the bottom of the post. 

[trevoralf]

I've resolved the AM install issue.  The debug version of AE that you've provided doesn't display the same problem so we're going to put the original version back on to see what happens and i'll post back.

[Rsullinger]

Hey Trevoralf,

 

No problem. Let me know if after installing it again, it returns. 

Edited January 6, 2017 by Rsullinger