torrey Posted December 11, 2018 ID:1286353 Share Posted December 11, 2018 We have had several machines producing alerts for wscript.exe on documents that do not contain an exploit. I can get you log files if needed. Here is the content of the alert email: Exploit code executing from Heap memory blocked BLOCK SYSTEM Wscript.exe C:\WINDOWS\System32\Wscript.exe Attacked application: C:\WINDOWS\System32\Wscript.exe; Parent process name: svchost.exe; Layer: Malicious Memory Protection; API ID: 301; Address: 0x7FC8038F; Module: ; AddressType: 0x00020000; StackTop: 0x7BD90000; StackBottom: 0x7BD88000; StackPointer: 0x7BD8DFA8; Extra: Thanks! Link to post Share on other sites More sharing options...
Staff Arthi Posted December 18, 2018 Staff ID:1287884 Share Posted December 18, 2018 Hi torrey, I have sent you a PM. Thanks. Link to post Share on other sites More sharing options...
Rob_B Posted January 7, 2019 ID:1291176 Share Posted January 7, 2019 We have been experiencing this same issue for months. Its awful with 98.6% of malwarebytes alerts being a false positive. Link to post Share on other sites More sharing options...
torrey Posted January 7, 2019 Author ID:1291179 Share Posted January 7, 2019 Rob_B if you engage MWB support they have a newer version of anti-exploit that stops the false positives - at least in our case. Link to post Share on other sites More sharing options...
Rob_B Posted January 7, 2019 ID:1291180 Share Posted January 7, 2019 Is it being released as a maintenance release? Link to post Share on other sites More sharing options...
torrey Posted January 7, 2019 Author ID:1291181 Share Posted January 7, 2019 All they said was that it would be pushed out in a future release. Link to post Share on other sites More sharing options...
Rob_B Posted January 7, 2019 ID:1291182 Share Posted January 7, 2019 Well.. I guess we can go out of the primary maintenance stream but I really like to stay in line with their production releases. Link to post Share on other sites More sharing options...
torrey Posted January 7, 2019 Author ID:1291184 Share Posted January 7, 2019 Me too. I had one group that is managed by a VB script evangelist and almost everything they do relies on scripting....sigh. They are the only group I deployed the fix to because they could not even print unless I turned MBAE off. Link to post Share on other sites More sharing options...
Staff Arthi Posted January 7, 2019 Staff ID:1291185 Share Posted January 7, 2019 Hi All, yes, We do have a newer version of Anti-Exploit that fixes this issue. It will be released in Malwarebytes end of this month. Until then, you can disable Exploit Protection in Malwarebytes and install the below tool in parallel. Starting February, you can uninstall this tool and enable Exploit protection back in Malwarebytes when this fix will be rolled over. https://malwarebytes.box.com/s/3c0phipczdzijp9lfn1rjf7v31jlw1fz Let me know if you have any questions. Thanks. Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now