Jump to content

MBAE stopped loading properly


MalJ

Recommended Posts

TOPIC:  MBAE stopped loading properly

I had been using MBAE beta successfully for several years on a Windows 7 SP1 (64-bit) installation. Recently, however, without any known system change or probable reason, I began to see a warning message after booting, indicating that the "service is taking too long to load" (image attached). Nothing changed after following the suggestion to reboot.

When I then attempted to start the service manually, I got the message that Windows was unable to do so for the same reason--load time was too long (image attached).

I then tried uninstalling, rebooting, downloading the latest version (1-12-1-42), installing, and rebooting. Now, I get no warning popup. However, no MBAE process exists. The Registry shows that the MBAE service is installed, and set to start type 2 (automatic) the service. However, although it is shown in the installed Services list, it remains in the stopped status.

I repeated that entire uninstall > reinstall process with a version that had worked previously, and with a 2nd download of the current version. Neither activity resolved the situation.

There is no malware problem on the machine. I have Webroot SecureAnywhere loaded, and it has not shown any problems. Its scans are clean. I even tried setting it not to block any of the MBAE executables, even though it would have shown me a popup message if it had been doing that.

Please advise how to proceed.

XPS410_SSD128_'Malwarebytes Anti-Exploit Service is taking too long to start'.png

XPS410_SSD128_Malwarebytes Anti-Exploit Service can't be started.png

Malwarebytes Anti-Exploit (Program Files x86 directory)_AS UPLOADED.zip

Malwarebytes Anti-Exploit (ProgramData directory)_AS UPLOADED.zip

Link to post
Share on other sites

  • Staff

Hi MalJ,

Thanks for posting.

From the logs, it looks like there might be a permission issue.

Can you please check if the following MBAE registry entry: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Malwarebytes Anti-Exploit is present. You can do so using the Registry Editor.

  1. If you find the entry, Please delete it and recreate it. If there is no entry, Please create it.
  2. Once you do so, Reinstall MBAE.

Let us know if that works.

Thanks.

Link to post
Share on other sites

Thanks for your reply, Arthi. It’s led to considerable improvement, but not resolution.

The subkey you mentioned did not exist, so I created a new subkey with the suggested name.

I then ran the installer, as Administrator, again, without uninstalling the existing installation.

After rebooting, I found that the newly-created Registry key was still there, but now had one value and data entry.

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Malwarebytes Anti-Exploit\\UUID –

                876BF6F0-EFF0-4342-9971-B8ED2BDC9584

Apparently as a result of other Registry changes, both mbae-sve.exe (32-bit) and mbae64.exe are now running as System processes which were loaded automatically.

However, there was a problem with the driver. Soon after the reboot was completed, mbae64.sys was loaded and running. However, now, about 2 hours later, it is no longer loaded.

Finally, even right after rebooting, the icon in the Notification Area, which animates to announce that protection is now being provided each time a browser window is opened, never appeared.

Rather than just include the files that have changed, I’ve wrapped the current contents of both the directories I uploaded previously.

Malwarebytes Anti-Exploit (Program Files x86 directory)_AFTER REINSTALL 031618_AS UPLOADED.zip

Malwarebytes Anti-Exploit (ProgramData directory)_AFTER REINSTALL 031618_AS UPLOADED.zip

Link to post
Share on other sites

Since the driver is not loading, I checked the Registry to see if a key had been created. I found that it had, which was not the case before the reinstall, so it is puzzling why it is not starting now.

REGEDIT4

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\ESProtectionDriver]

"Type"=dword:00000001

"Start"=dword:00000001

"ErrorControl"=dword:00000001

"ImagePath"=hex(2):5c,3f,3f,5c,43,3a,5c,50,72,6f,67,72,61,6d,20,46,69,6c,65,73,\

  20,28,78,38,36,29,5c,4d,61,6c,77,61,72,65,62,79,74,65,73,20,41,6e,74,69,2d,\

  45,78,70,6c,6f,69,74,5c,6d,62,61,65,36,34,2e,73,79,73,00

"DisplayName"="Malwarebytes Anti-Exploit"

"WOW64"=dword:00000001

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\ESProtectionDriver\Enum]

"0"="Root\\LEGACY_ESPROTECTIONDRIVER\\0000"

"Count"=dword:00000001

"NextInstance"=dword:00000001

 

Link to post
Share on other sites

  • 2 weeks later...

Not sure if this issue has been resolved - but I also had similar symptoms and error messages on a Win7x64 system running MBAE build 43.

I experienced MBAE loading but not working - the MBAE driver Failing to load with the error message quoted above - and the Notification Area icon failing to appear. 

I just posted about the issue & fix on another thread here:  Issues with Win7 & Google Chrome

The fix for me was to install MBAE build 57 - despite no related issues being listed as fixed - and all is now working fine. 

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.