Chrome vs. MB "Exploit Protection" -- crashing Chrome extensions upon launch

[Advn303]

Today the latest version of Google Chrome started to fail upon launch when I have the MalwareBytes Premium 3.0.6  "Exploit Protection"  enabled.  Upon launching Chrome, all my extensions immediately report by Chrome as "crashed" (pop-up in browser) and the browser window is a black screen (but menus are normal).  Unable to access Chrome settings or any Chrome features, but can close Chrome window and not much else.   If I turn off MalwareBytes "Exploit Protection" or just disable protection for Chrome.exe via Manage Protected Applications > uncheck "Google Chrome (and plug-ins)", then everything returns to normal when I launch Chrome again.   I've checked on multiple Windows user profiles on this same machine that have different extensions installed and behavior is identical.  MalwareBytes doesn't report any issues (no explicit detection of problems).  Didn't find anything interesting in Windows logs, and no different after system reboot. 

• Chrome is Version 57.0.2987.133 
• Windows 10 Pro 64-bit (10.0.14393 build 14393.969 -- version 1607, latest security patches applied including KB4015438).  
• Malware Bytes is version 3.0.6.1469, Comp pkg 1.0.96, Update pkg 1.0.1681.  
  • Using NON-DEFAULT Settings: Web Protection=OFF, Exploit Protection= ON, Malware Protection= OFF (just doing frequent scans), Ransomware protection= ON.  

I'm 99% sure my computer IS NOT infected with anything, as all scans (multiple tools) are clean, nothing else out of the ordinary happened lately (no likely infection vectors), and the symptoms have the feel of a Security software vs Application version incompatibility issue.   

Perhaps I will try to try to remove/reinstall Chrome in case Chrome install is corrupted.  Could also run experiment by creating a new windows user with no Chrome extensions at all and check behavior with Exploit Protection turned back on.  But BEFORE I go wasting hours debugging this, I'd like to know if anyone else is seeing this issue with same latest version of Chrome and MB 3.0.6 with Exploit Protection ON/OFF.   Please post a reply if you see same issue and have success with same workaround of disabling exploit protection for Chrome.  

[arbrich]

I am having the same issue with Chrome and Firefox, IE and Edge are working. I uninstalled, used mbam-clean, reinstalled and still the same issue. If I turn Exploit protection off they both work.

Edited April 8, 2017 by arbrich

[GaryFDes]

Same problem here with Chrome.  I turned off Exploit Protection and everything started working again.  Of course, now I get information about not being fully protected every time I turn on my computer as "Real-Time Protection layers turned off".  No way I can see to say I don't care and stop telling me.

I have tried the "Advanced Settings" and nothing I could find stops chrome plugins from crashing and chrome from being blank except to turn the all of Exploit Protection off.

Hate to say it but Malwarebytes has seemed a bit unstable lately.

Edited April 8, 2017 by GaryFDes

[GaryFDes]

More information on this that might help.

I have the problem with:

Malwarebytes version: 3.0.6.1469

Component package version: 1.0.96

Update package version: 1.0.1686

My wife does not have this problem with:

Malwarebytes version: 3.0.6.1469

Component package version: 1.0.75

Update package version: 1.0.1686

I am not sure why we have different "Component package version"s but there you go.

 

(Same chrome versions: 57.0.2987.133, same Windows 10 versions)

Edited April 8, 2017 by GaryFDes

[Advn303]

I was also unable a solution by to fine tuning settings under Anti-Exploit Protection > Advanced settings.  Even turning all options off didn't work, had to disable for chrome.exe or disable entirely, same as GaryFDes.    

Good observation GaryFDes that problem may be dependent on Component package version, which is very believable since I think that version 57 of Chrome was out for a few weeks before this problem surfaced. 

I haven't tried to replicate with Firefox as reported, but if that is the case, then issue is not limited to Chrome, so I won't go reporting in Chrome user forums.  I think we need to open support ticket with MB if they are not already aware (no official response here).   

Cheers.

[dcollins]

We are aware looking into the issue, in helps to troubleshoot it, please provide the logs outlined in the following thread:

 

Edited April 11, 2017 by dcollins

[Advn303]

FYI, cross reference to similar report of same issue from few days ago that I missed on first pass.   And adding some detailed info from logs below.

Looks like Comp Pkg update to 1.0.96 was not the trigger for my system, as issue didn't start until after a system reboot on 2017-04-07 in the afternoon, but "SDK/Controller package --> [mbam-c.ctlr.64bit], current version: [1.0.96]" was on my system for at least a few days prior, per "C:\ProgramData\Malwarebytes\MBAMService\logs\MBAMSERVICE.LOG"

Best I can tell the MB update that happened closest most likely just prior to start of issue was the install of these just after power up around 17:15 was

04/07/17    " 17:24:47.681"    441390    0bd8    104c    INFO    UpdateControllerImpl    mb::updatecontrollerimpl::CUpdateControllerImpl::UpdateInstalledPkgVersion    "UpdateControllerImplHelper.cpp"    2203    "Successfully updated DB/ClsEng package version to: 1.0.1680"

04/07/17    " 17:24:58.025"    451734    0bd8    104c    INFO    UpdateControllerImpl    mb::updatecontrollerimpl::CUpdateControllerImpl::UpdateInstalledPkgVersion    "UpdateControllerImplHelper.cpp"    2203    "Successfully updated DB/ClsEng package version to: 1.0.1681"

shortly after that Google Chrome started failing to launch...and then I rebooted my system around 17:30 to attempt to resolve. 

Sorry can't do the more intrusive log collection or post full MBAMSERVICE.LOG until I have time to scrub out PII, as this log contains references to user space files and paths. 

[BillH99999]

I am posting this only because I haven't seen anyone else mentioning that they are not having the problem.  I am using the latest version of Chrome and MB3 CU4 and I am not having any issues with Chrome or any of the Chrome extensions I am using... at least so far.

[Porthos]

25 minutes ago, BillH99999 said:

I am posting this only because I haven't seen anyone else mentioning that they are not having the problem.  I am using the latest version of Chrome and MB3 CU4 and I am not having any issues with Chrome or any of the Chrome extensions I am using... at least so far.

 

I can concur. My 2 system and 6 since Wednesday. No issues Win 10 1703.

[BobbyA]

I have the same problem, I must disable exploit protection in order for chrome to function. My extensions are immediately killed if I turn on exploit protection.

Windows 10, 64 bit, latest version of chrome, Malware Bytes version 3.0.6.1469, Comp pkg 1.0.96, Update pkg 1.0.1688 

Installed MWB 3.0 for first time replacing old version of MWB on April 7

[dcollins]

As I mentioned above, if you're having this issue, please provide the requested so we can troubleshoot what's going on. Also note, many people have reported that having both Norton Exploit Protection and Malwarebytes Exploit Protection seems to cause this. You may be able to turn one of them off to resolve this issue as well, instead of unblocking specific applications

 

Edited April 9, 2017 by dcollins

[dhlucien]

I have MB version 3.0.6.1469. and Chrome Version 57.0.2987.133.  In order for Chrome to work, I have to either rename the Chrome executable to something else (chrom1.exe) or turn off realtime protection in MB.  Started a week ago.  If nothing is done, Chrome opens empty gray pages with Untitled in the tab.  The settings, extensions and all other pages also come up blank and gray.

[dhlucien]

MB component package version 1.0.96

[BobbyA]

4 minutes ago, dhlucien said:

I have MB version 3.0.6.1469. and Chrome Version 57.0.2987.133.  In order for Chrome to work, I have to either rename the Chrome executable to something else (chrom1.exe) or turn off realtime protection in MB.  Started a week ago.  If nothing is done, Chrome opens empty gray pages with Untitled in the tab.  The settings, extensions and all other pages also come up blank and gray.

Wonder if all chrome users are seeing this problem? I  turn off exploit protection, but hoping for a fix. Kills all my chrome extension, have only a few of them. Wonder if others with this problem run Norton security along with MWB 3.0.6. If you don't open chrome, you can temporarily turn on exploit protection and run a full scan which completes OK. Then turn off exploit protection to open chrome to get your work done.

[dhlucien]

I saw at least one thread on the Google Chrome forums from the past 2 weeks.  Google has not responded.  I have 4 Windows 10 computers on my network that have been effected so far.  Those 4 happened over the course of a week.  I just noticed I have at least one Windows 10 computer with those same versions that is still working okay..so I don't know if there is an additional conflict that spurs the problem.  

[BillH99999]

As I mentioned earlier in this post, I have the latest Chrome, Norton Security, MB3 CU4, and Windows 10 and I am  not experiencing the problem.

Could it be one of the addons in Chrome causing the problem.  Have you tried using Chrome in Safe Mode -or- disabling all addons and seeing if that corrects the problem?

[dhlucien]

Here is the log file that includes the time Chrome stopped working on one of the Windows 10 computers.  Chrome stopped working on April 10 around 9am.  There is an update to MB that takes place around that time.

MBAMSERVICE (1).LOG

[BobbyA]

19 minutes ago, BillH99999 said:

As I mentioned earlier in this post, I have the latest Chrome, Norton Security, MB3 CU4, and Windows 10 and I am  not experiencing the problem.

Could it be one of the addons in Chrome causing the problem.  Have you tried using Chrome in Safe Mode -or- disabling all addons and seeing if that corrects the problem?

I just turned off every one of my chrome extensions. It DOES NOT solve the problem. After doing this and turning on exploit protection, chrome could not access any web page. Just presents a dark chrome screen even when trying to load my home page.

[BillH99999]

1 minute ago, BobbyA said:

I just turned off every one of my chrome extensions. It DOES NOT solve the problem. After doing this and turning on exploit protection, chrome could not access any web page. Just presents a dark chrome screen even when trying to load my home page.

Sorry to hear that.  It was worth a try anyway.  Hope you find what is causing the problem.

[lmacri]

Have users tested for a possible conflict with the anti-exploit protection in MB 3.0.6 CU4 (component package 1.0.96) and other software like Norton Security, HitmanPro Alert and Microsoft's Enhanced Mitigation Experience Toolkit (EMET)?

A few users in this forum like Phone Man and Firerizer have reported that MB's anti-exploit protection works correctly with both Chrome and Firefox if exploit prevention in Norton Security is disabled (Settings | Firewall | Intrusion and Browser Protection |  Exploit Prevention | OFF).  See posts # 6 and #7 in Firerizer's thread 3.0.6.1469-1096 Kills Chrome/Extensions.
-----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.0.2 * NIS v22.9.1.12 * MBAM Premium v2.2.1

[BillH99999]

4 minutes ago, lmacri said:

A few users in this forum like Phone Man and Firerizer have reported that MB's anti-exploit protection works correctly with both Chrome and Firefox if exploit prevention in Norton Security is disabled (Settings | Firewall | Intrusion and Browser Protection |  Exploit Prevention | OFF).

I have exploit prevention in Norton Security enabled and as I mentioned, I am not having the problem so it looks like there is possibly something else in play as well.  Even so, if this gets things working for someone it may be the temporary work around that they should use until the solution is found.

Edited April 11, 2017 by BillH99999

[dcollins]

We've been able to replicate this and are looking into solutions. It looks to be 32-bit Chrome with Norton Exploit Protection and MB3 Exploit Protection. Switching to 64-bit Chrome where applicable, or disabling one of the Exploit Protections will solve the issue for the time being

[BillH99999]

That is the difference, I am running 64-bit Chrome and am not having any problems.  Glad you were able to figure it out.

[BobbyA]

49 minutes ago, dcollins said:

We've been able to replicate this and are looking into solutions. It looks to be 32-bit Chrome with Norton Exploit Protection and MB3 Exploit Protection. Switching to 64-bit Chrome where applicable, or disabling one of the Exploit Protections will solve the issue for the time being

It looks like I was using 32 bit Chrome which was loaded a few years ago. I downloaded and re-installed Chrome. This now shows Version 57.0.2987.133 (64-bit). 

This seems to have fixed this problem, I now keep MB exploit protection on as well as Norton Security exploit protection on. Thanks for the solution.

[Advn303]

Thanks to all for the support and information and @dcollins for the information MB team's findings of the bad combinations.  I did have Norton Security Suite running with exploit protection on, which I was not even aware was part of that program suite.  I have now disabled Norton Security exploit protection (per above under Settings > Firewall > Intrusion and Browser Protection >  Exploit Prevention > OFF), and upgraded my Google Chrome to 64-bit (was 32-bit).  Chrome problem no longer occurring with MB3 Exploit Protection back on and enabled for chrome.exe (advanced exploit settings back to defaults).  All seems to be working now (currently at MB 3.0.6.1469, Comp pkg 1.0.103, Update pkg 1.0.1784).   I think running exploit protection in both Norton Security and MB3 simultaneously is probably bad idea, so will keep that feature disabled in Norton Security. 

Side note:  My preferred config is to let Norton Security run real-time anti-virus/anti-malware file access scans, manage temp file cleanups, and provide log of my installs/downloads, and handle smart firewall.  I'm using  MB3 for scheduled daily file system scans, real-time ransomware protection, and anti-exploit protection.  If MB3 added detailed logging of downloads/installs and something similar to the reputation-based "File Insight" lookup, plus firewall management (especially outgoing based on reputation), then I could just use MB3 alone.   I like the new MB3 innovations for anti-ransomware (behavior-based file access monitoring) and fine grained anti-exploit protection (looks to be similar to full Microsoft EMET).