Leawo Blu-ray Player

[BillH99999]

Just started getting this.  I've used Leawo for years and just started getting the block.  Is this a real exploit or a false positive?

Thanks,
Bill

 

[BillH99999]

I should have said I'm using Version 3.6.1.2711 with component package 1.0.463 on Windows 10 Pro 64-bit with the latest updates.

Thanks,
Bill

[BillH99999]

Has anyone on staff seen this email?  Is this a false positive?

Thanks
Bill

[BillH99999]

Where is everybody???? No one from staff has replied to this forum in over a month.  Are they still monitoring this forum?

[Arthi]

Hi BillH99999,

Thanks for posting. Can you please use the tool in the link below and get us some logs.

 

[BillH99999]

@Arthi

Here are the logs.

 

mbst-grab-results.zip

[BillH99999]

@Arthi

By the way, the instructions for guided use say "If you are not already in contact with Malwarebytes Support via email, proceed by placing a checkmark next to I do not have a support ticket and click the Next button.".  There is no such question on the screen.

[Arthi]

Thanks for the logs. I will ask the concerned team to look into the Support tool instructions as well.

[Arthi]

Hi,

We looked at your logs, it looks like you have added the Blu-ray player as a custom shield to be protected by Anti-Exploit. You can disable CALL ROP Gadget Detection (32 bit) for Media Players as a workaround while we wait for the permanent fix to be released.

Thanks.

[BillH99999]

@Arthi

Thanks for the reply.

I added the Blu-ray Player to the protected applications because I saw that VLC and Windows media player were already in the list and figured Blu-ray Player is the same type of program.

I have no idea what you are talking about when you say "disable ROP Gadget Detection (32 bit) for Media Players".  How would I do that?  What is ROP Gadget Detection?  What would disabling this do?

So this is a false positive not a real exploit?

Thanks,

Bill

[Arthi]

Hi Bill,

This is a False positive and not a real exploit attack. In the Malwarebytes product UI, go to Settings on the left-> Protection Tab on the top -> Click on Advanced Settings under Exploit Protection and Disable the checkbox in RED in the below image, and Hit Apply to disable this FP causing protection.

Return Oriented Programming (ROP) is an exploit technique that malicious actors typically employ to execute code in the target machine. You can understand more on this 

https://www.rapid7.com/resources/rop-exploit-explained/

Let me know if you have any questions. Thanks.

[BillH99999]

@Arthi

Thanks for the info.  I think I'll just wait until there is a permanent fix for the program.  I don't want to disable anything that could open me up for an attack.

Thanks
Bill

[BillH99999]

@Arthi

Any update on when we might expect a fix for this?

Thanks
Bill

[BillH99999]

@Arthi

Still happening in version 1.0.32.

Bill

 

[Arthi]

Hi,

This fix will be released end of the month. Thanks.

[BillH99999]

@Arthi

Thanks for the update.  I was confused, I was thinking this was the Chome beta that was blocking it but it was Malwarebyte itself.

Bill

[Arthi]

Yes, the false positive is with the Anti-Exploit module of Malwarebytes, and the fix can be expected end of this month.

[BillH99999]

@Arthi

Just wondering about the status on this.  You had indicated the fix would be released at the end of the month, but it is still being blocked.

Thanks,
Bill

[Arthi]

Hi BillH99999,

The fix is still on track for release but the official release date has been pushed by a week and is currently slated for 1st week of December. Please follow this post

 

[BillH99999]

@Arthi

Just to let you know... I downloaded the beta and that did take care of the problem.

Thanks!
Bill

[Arthi]

Perfect. Thanks for confirming. Have a nice weekend !!