Problems with HP Printer Assistant Software

[bully]

Whenever i open this utility i get a message saying MWB AE has blocked an exploit attempt and the application is shut down. Although the HP utitlty has been on my PC for some time this is the first time i have used it. Strangely it worked OK for a while, then the messages started appearing - followed by a shut-down whichever button i pressed in the application.

 MWB AE gives the following information

Application mshta

Protection Layer Application Behavior Protection

Protection Technique  Exploit payload process blocked

File/Process blocked C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe printui.dll,PrintUIEntry \e \n HP DJ 2130 series

Attacking URL N/A

Can you tell me what is going on please?

[Arthi]

Hi bully,

Thanks for posting. Can you please provide some logs for us to look into your issue. 

 

[bully]

Thanks - i couldn't see how to but i shoul d have read the thread. Here they are.

Malwarebytes Anti-Exploit.zip

[bully]

I got your PM as an email, but i can't read it properly without signing in and it tells me that my p/w is wrong. Which it isn't because i'm writing this now. Also the link works but tells me there is no file to download. Not much help. I think i'll just uninstall MWB AE.

[Arthi]

Hi bully,

Can you please try the below build and see if it resolves your issue.

https://malwarebytes.box.com/s/i9lc81gtjn73lvhfmjxprfk97xbg9rof

Thanks.

[bully]

Hi Arthi - thanks for your efforts. But after running mbae_debugging.bat, the HP application has worked faultlessly. It seems unnecessary to install this build, or is it a routine update that i should install anyway?

[Arthi]

Hi bully,

We would advise you to update the build since we keep monitoring all the exploit attacks in the wild and keep updating our protections to block them, regularly, so it is important to always have the latest build. Having said that, if you can install the above test build and let us know if it resolves your issue, it will be a great help for us to consider this fixed and release it out to everybody.

Thanks.

 

[bully]

OK i'll do it and let you know if there are any complications.

Thanks.

[bully]

Well, i uninstalled 1.09.1.1410 and installed 1.12.1.140 and the problem returned: I can open HP Printer Assistant but as soon as i try to use it MWB AE shuts it down. I get the same error messages as before with a very slight variation for File/Process blocked. I now get: 

 C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe printui.dll,PrintUIEntry \o \n HP DJ 2130 series

not

C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe printui.dll,PrintUIEntry \e \n HP DJ 2130 series

[Arthi]

Hi bully,

We uncovered another issue, and fixed it. This build should be good

https://malwarebytes.box.com/s/x4tymleh82850j8cld3v39dcwtn7ktgp

 

[bully]

That seems to have cured it, thanks!