Jump to content

Windows Insider Builds and Exploit Protection


Recommended Posts

Windows Insider builds 17074 & 17083 causing MBAM exploit protection to turn off in version 3.3.1.  17063 and previous were fine.  Multiple attempts at clean install of MBAM using the Clean tool (current version) fail to rectify.  Uninstall, reboot and re-install go fine, after just a few seconds, Exploit gets turned off.  Running out of tricks.....

2018-01-25_11h24_29.thumb.png.137a19c3107ce71114872dc0dcc6f872.png

 

Link to post
Share on other sites

  • Staff

***This is an automated reply***

Hi,

Thanks for posting in the Malwarebytes 3 Help forum.

 

If you are having technical issues with our Windows product, please do the following: 

Spoiler

If you haven't done so already, please run these two tools and then attach the logs in your next reply:

NOTE: The tools and the information obtained is safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

  • Farbar Recovery Scan Tool (FRST)
    1. Download FRST and save it to your desktop
      Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit
    2. Double-click to run FRST and when the tool opens click "Yes" to the disclaimer
    3. Press the "Scan" button
    4. This will produce two files in the same location (directory) as FRST: FRST.txt and Addition.txt
      • Leave the log files in the current location, they will be automatically collected by mb-check once you complete the next set of instructions
  • MB-Check
    1. Download MB-Check and save to your desktop
    2. Double-click to run MB-Check and within a few second the command window will open, press "Enter" to accept the EULA then click "OK" 
    3. This will produce one log file on your desktop: mb-check-results.zip
      • This file will include the FRST logs generated from the previous set of instructions
      • Attach this file to your forum post by clicking on the "Drag files here to attach, or choose files..." or simply drag the file to the attachment area

One of our experts will be able to assist you shortly.

 

If you are having licensing issues, please do the following: 

Spoiler

For any of these issues:

  • Renewals
  • Refunds (including double billing)
  • Cancellations
  • Update Billing Info
  • Multiple Transactions
  • Consumer Purchases
  • Transaction Receipt

Please contact our support team at https://support.malwarebytes.com/community/consumer/pages/contact-us to get help

If you need help looking up your license details, please head here: https://support.malwarebytes.com/docs/DOC-1264 

 

Thanks in advance for your patience.

-The Malwarebytes Forum Team

Link to post
Share on other sites

2 minutes ago, f14tomcat said:

causing MBAM exploit protection to turn off in version 3.3.1.  17063 and previous were fine. 

Please post the logs from the above automated reply. Click the first "Reveal hidden comments" box for the needed logs.

The Forum team is looking forward to assisting you.

This is NOT an automated reply.

Thanks.

Link to post
Share on other sites

17 minutes ago, Porthos said:

Please post the logs from the above automated reply. Click the first "Reveal hidden comments" box for the needed logs.

The Forum team is looking forward to assisting you.

This is NOT an automated reply.

Thanks.

Ok, I'm not on the Insider at the moment.  Will have to boot into it and get the logs.   Be a few minutes.  Thanks.

Link to post
Share on other sites

4 minutes ago, f14tomcat said:

Ok, here's the Zip! 

Quote

"controllers_version" : "1.0.273",

You're using the beta, which has some known issues . I would recommend reinstalling the latest stable version by using mb-clean from https://downloads.malwarebytes.com/file/mb_clean

Edited by Porthos
Link to post
Share on other sites

I even did the MB-Clean without reinstalling.  Ran Revo Uninstaller to look for any dust bunnies.  It found a few...some images, couple of reg entries.  Then DL'd and ran the full installer.  It activated without me doing anything.   I'll be off for the day shortly, so will check back tomorrow.  Thanks to you and all the staff.  Let me know if you need any more info.  currently at this:

 

2018-01-25_20h28_18.thumb.png.521b1bcbe3bcddfdd476313cf4ae73f1.png

Link to post
Share on other sites

Hey, Tom, Porthos, staff - I'm currently finishing up a clean install of Fall Creator's build, and after imaging I will be re-joining the Insiders Program on this install, which already has MB 3 latest and Defender running side by side.

Regardless of whether the issue crops up upon install of 17083, I'll post back.

Link to post
Share on other sites

On 2/2/2018 at 6:45 PM, Arthi said:

HI f14tomcat,

Thanks for reporting it. We will look into it and get back to you.

Thanks, Arthi.  Quick update.  Just installed Insider Build 17093 released yesterday 2/07/18.  No change.  In systray, comes up all protected for about 10 seconds, then Exploit pops off. 

2018-02-08_14h11_43.png.ed095282f16eee928439a67b235b30b4.png

Link to post
Share on other sites

5 hours ago, Arthi said:

HI f14tomcat,

Have you enabled credential guard in your Insider build? If so, can you please turn it off. Exploit Protection is at the moment incompatible with credential guard feature. We are working on a fix which should solve this issue. Hoping to release it soon.

Thanks.

Hello, Arthi.

 

No, I do not not have credential guard enabled.  Not running Hyper-V or any other VM on this build.

 

Good news!  I have just finished installing MBAM 3.4.0 on the 17093 Insider, and Exploit protection remains enabled!  Ran several scans, and restarted several times.  All is holding.  No changes to Insider settings at all.  Something in 3.4.0 is changed/fixed to now be compatible.  I will continue to monitor,  especially after the next build, which should be Wed/Thu this week.  Thank you all for your help.  If there is any info I can supply, please let me know.  Post here, or email at the email in my registration.  Attached 3 screenshots.

Thanks, again.....

 

2018-02-13_16h51_49.png

2018-02-13_16h45_07.png

2018-02-13_16h57_08.png

Edited by f14tomcat
Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.